presstigers 関連製品全体の CVE とセキュリティ脆弱性情報を集約し、CVSS、EPSS、公開日、脆弱性情報データを掲載しています。
過去の問題は主に vendor risk cross-site scripting and vendor risk csrf などに関し、一部は vendor impact session compromise を招き、vendor surface software deployment and vendor surface production workloads 関連の場面に影響します。
掲載データは公開脆弱性情報とセキュリティ公告に基づき、過去の暴露面と修補優先度の評価に利用できます。
| CVE | 概要 | ソース | CVSS 最大値 | EPSS（%） | 公開 | 更新 |
|---|---|---|---|---|---|---|
| CVE-2024-7762 | The Simple Job Board WordPress plugin before 2.12.6 does not prevent uploaded files from being listed, allowing unauthenticated users to access and download uploaded resumes | [email protected] | 3.7 | 0.34% | 2025-05-15 | 2026-06-17 |
| CVE-2024-7761 | In the process of testing the Simple Job Board WordPress plugin before 2.12.2, a vulnerability was found that allows you to implement Stored XSS on behalf of the editor by embedding malicious script, which entails account takeover backdoor | [email protected] | 6.1 | 0.32% | 2025-05-15 | 2026-06-17 |
| CVE-2023-47188 | Missing Authorization vulnerability in PressTigers Simple Job Board simple-job-board allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Job Board: from n/a through <= 2.10.5. | [email protected] | 5.3 | 0.43% | 2025-01-02 | 2026-06-17 |
| CVE-2024-7351 | The Simple Job Board plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.3 via deserialization of untrusted input when editing job applications. This makes it possible for authenticated attackers, with Editor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbit | [email protected] | 7.2 | 0.62% | 2024-08-24 | 2026-06-17 |
| CVE-2024-1813 | The Simple Job Board plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.11.0 via deserialization of untrusted input in the job_board_applicant_list_columns_value function. This makes it possible for unauthenticated attackers to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code when a submitte | [email protected] | 9.8 | 1.11% | 2024-04-09 | 2026-06-17 |
| CVE-2024-0593 | The Simple Job Board plugin for WordPress is vulnerable to unauthorized access of data| due to insufficient authorization checking on the fetch_quick_job() function in all versions up to, and including, 2.10.8. This makes it possible for unauthenticated attackers to fetch arbitrary posts, which can be password protected or private and contain sensitive information. | [email protected] | 5.3 | 0.91% | 2024-02-21 | 2026-06-17 |
| CVE-2023-52122 | Cross-Site Request Forgery (CSRF) vulnerability in PressTigers Simple Job Board.This issue affects Simple Job Board: from n/a through 2.10.6. | [email protected] | 4.3 | 0.22% | 2024-01-05 | 2026-06-17 |
| CVE-2023-48283 | Cross-Site Request Forgery (CSRF) vulnerability in PressTigers Simple Testimonials Showcase allows Cross Site Request Forgery.This issue affects Simple Testimonials Showcase: from n/a through 1.1.5. | [email protected] | 4.3 | 0.17% | 2023-11-30 | 2026-06-17 |
| CVE-2023-29440 | Cross-Site Request Forgery (CSRF) vulnerability in PressTigers Simple Job Board plugin <= 2.10.3 versions. | [email protected] | 4.3 | 0.31% | 2023-11-10 | 2026-06-17 |
| CVE-2022-2558 | The Simple Job Board WordPress plugin before 2.10.0 is susceptible to Directory Listing which allows the public listing of uploaded resumes in certain configurations. | [email protected] | 5.3 | 0.76% | 2022-08-22 | 2026-06-17 |
| CVE-2022-25612 | Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities in Simple Event Planner WordPress plugin <= 1.5.4 allows user with author or higher user rights inject the malicious code via vulnerable parameters: &custom[event_organiser], &custom[organiser_email], &custom[organiser_contact]. | [email protected] | 4.1 | 0.55% | 2022-03-25 | 2026-06-17 |
| CVE-2022-25611 | Authenticated Stored Cross-Site Scripting (XSS) in Simple Event Planner plugin <= 1.5.4 allows attackers with contributor or higher user roles to inject the malicious script by using vulnerable parameter &custom[add_seg][]. | [email protected] | 4.1 | 0.55% | 2022-03-25 | 2026-06-17 |
| CVE-2021-39328 | The Simple Job Board WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping on the $job_board_privacy_policy_label variable echo'd out via the ~/admin/settings/class-simple-job-board-settings-privacy.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 2.9.4. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is | [email protected] | 5.5 | 0.89% | 2021-10-21 | 2026-06-17 |
| CVE-2020-35749 | Directory traversal vulnerability in class-simple_job_board_resume_download_handler.php in the Simple Board Job plugin 2.9.3 and earlier for WordPress allows remote attackers to read arbitrary files via the sjb_file parameter to wp-admin/post.php. | [email protected] | 7.7 | 30.48% | 2021-01-15 | 2026-06-16 |
| CVE-2017-18498 | The simple-job-board plugin before 2.4.4 for WordPress has reflected XSS via keyword search. | [email protected] | 6.1 | 0.92% | 2019-08-13 | 2026-06-16 |