CVE-2025-32626 is a critical (CVSS 9.3) SQL injection in JoomSky's JS Job Manager plugin (js-jobs) for WordPress, in versions through 2.0.2. It needs no login. The record names no fixed version, so update to the latest release and consider removing the plugin until you are sure.
What's affected
JS Job Manager (slug js-jobs) from the first release through 2.0.2, per the CVE record, which draws on a Patchstack report. No fixed version appears in the record, so read the plugin change log for the first release after 2.0.2.
The vector shows network access, low complexity, no privileges and no user interaction, with a changed scope. High confidentiality impact and low availability impact make up the rest of the score.
A job board plugin takes input from the public, such as searches and applications. That means the vulnerable surface faces visitors by design. The same plugin also has a critical arbitrary file upload issue, covered in CVE-2025-32660.
How to check if you're exposed
Check the installed version with WP-CLI:
wp plugin get js-jobs
If you use the admin screens instead, open Plugins and read the version for JS Job Manager. Anything at 2.0.2 or lower is in scope.
Search your web logs for unusual requests to the plugin's endpoints with long or odd parameter values, and review database logs for errors from malformed queries.
What to do now
- Update JS Job Manager to a release newer than 2.0.2, after reading its change log.
- If no fix is available, deactivate the plugin and remove it.
- Use a database account for WordPress that has only the privileges it needs.
- Consider a web application firewall rule set as a stopgap, with the understanding that it does not replace the update.
- Check the database for new administrator accounts or changed user rows if the site was exposed.
Why it matters
The class is CWE-89 (SQL Injection). Input is placed into a query without proper neutralization, so the caller can change what the database runs. The impact in the vector is high for confidentiality, which fits the reading of stolen rows such as user records and password hashes.
Parameterized queries are the durable answer. WordPress offers a prepare function for exactly this purpose, and plugins that skip it keep producing entries like this one.
The record does not mark this CVE as CISA KEV and makes no claim of exploitation in the wild.
Try it yourself
Injection flaws on public pages are what dynamic scanning is built to find. This demo walks through a web app scan and its findings.
Click through it at your own pace, or open it full screen.
Quick check
There are two critical CVEs for this plugin. Do I need to act on both?
Yes, but one update normally covers both if the vendor fixed them together. Read the change log for the release after 2.0.2 and confirm both issues are addressed.
Sources
Last reviewed: 18 October 2026.
