CVE-2025-22294 PoC — WordPress Custom Field For WP Job Manager plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability

Source

https://github.com/mirmeweu/cve-2025-22294

Associated Vulnerability

Title: WordPress Custom Field For WP Job Manager plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVE-2025-22294)
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in theme funda Custom Field For WP Job Manager custom-field-for-wp-job-manager allows Reflected XSS.This issue affects Custom Field For WP Job Manager: from n/a through <= 1.3.

Description

the task from C*****k

Readme

# CVE-2025-2294 – Local File Inclusion (LFI) в WordPress-плагине Kubio AI Page Builder

- ### [Ссылка на подробный райтап](write-up.md)
- ### [Ссылка на деплой](deploy/)
- ### [Ссылка на сплойт](52125.py)
- ### Ссылка на файлы, для массовой проверки:
    - [Шаблон для активной проверки](mass_check/active.yaml)
    - [Шаблон для пассивной проверки](mass_check/passive.yaml)
    - [Сплойт для массовой проверки на Python](mass_check/mass_check.py)
    - [Сплойт для массовой проверки на Golang](mass_check/active.go)

- ### Все картинки подгружаются с папки [images](images/)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →