CVE-2025-3918: Nootheme Job Listings

Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days.

The Job Listings plugin for WordPress is vulnerable to Privilege Escalation due to improper authorization within the register_action() function in versions 0.1 to 0.1.1. The plugin’s registration handler reads the client-supplied $_POST['user_role'] and passes it directly to wp_insert_user() without restricting to a safe set of roles. This makes it possible for unauthenticated attackers to elevate their privileges to that of an administrator.

Affected products

• Nootheme Job Listings: from 0.1, up to and including 0.1.1

Published 2025-05-03. Last modified 2026-06-17.