CVE-2025-22294 - Reflected XSS in Gravity Master Custom Field For WP Job Manager

Date: June 2024
Vulnerability Type: Cross-site Scripting (Reflected XSS)
Affected Plugin: Custom Field For WP Job Manager (by Gravity Master)
Versions: All before and including 1.3
CVE: CVE-2025-22294
Severity: Medium

Exclusively Written by ChatGPT

If you use the “Custom Field For WP Job Manager” plugin by Gravity Master on your WordPress site, you need to know about an important security bug: CVE-2025-22294. In this post, we’ll break down what it is, how attackers can use it, and what you should do now.

What Is The CVE-2025-22294 Vulnerability?

CVE-2025-22294 is a reflected Cross-site Scripting (XSS) vulnerability found in the Custom Field For WP Job Manager plugin for WordPress. Reflected XSS lets attackers inject malicious scripts into web pages viewed by other users.

The vulnerable code appears to not properly clean or “neutralize” input data before displaying it on a web page. This makes it possible for someone to trick an admin or user into clicking a malicious link, which will execute a script in their browser.

Affected Versions:
- All versions from the start (n/a) through 1.3 are vulnerable.

Where Is The Problem? (Tech Details)

In the plugin code (before version 1.3), user input from GET or POST requests is sometimes directly included in the web page’s HTML without proper escaping.

Let’s see a hypothetical code snippet (for learning!) that shows this kind of vulnerability

// Vulnerable code snippet
if ( isset( $_GET['custom_field'] ) ) {
    echo 'Custom field value: ' . $_GET['custom_field'];
}

What’s wrong:
The code directly outputs user input ($_GET['custom_field']) without escaping. If an attacker includes a script inside that parameter, it will run in the user’s browser!

Example Exploit

Let’s imagine the plugin uses the above code on a page like /jobs/.

An attacker crafts a malicious URL

https://victimsite.com/jobs/?custom_field=<script>alert('XSS')</script>;

If an admin clicks this, a popup will appear—but a real attack could steal cookies, rewrite pages, or take over accounts.

Responsible Disclosure & References

- Official CVE database entry: https://nvd.nist.gov/vuln/detail/CVE-2025-22294
- WordPress plugin page: https://wordpress.org/plugins/custom-field-for-wp-job-manager/
- XSS overview: OWASP Cross-site Scripting (XSS)

## How To Fix (for Site Owners/Developers)

Upgrade:
As soon as a patched version is out, UPGRADE the plugin. If no fix exists, disable the plugin until it’s repaired.

Manual Patch Example:

Edit the vulnerable code to use esc_html(), like this

if ( isset( $_GET['custom_field'] ) ) {
    echo 'Custom field value: ' . esc_html( $_GET['custom_field'] );
}

Above, esc_html() escapes JavaScript and HTML tags, blocking XSS.

General Advice:

How Security Pros Might Prove It Works (For Educational Purposes Only!)

Manual Test:

Find a page using the plugin’s field in the URL.

2. Append ?custom_field=<script>alert(1)</script> to the URL.
3. Open the link in a browser to see if the alert fires. (Do not test this on sites you don’t own/leagally control.)

Automated Tools:
- Burp Suite
- OWASP ZAP

Summary

CVE-2025-22294 is a reflected XSS in the Gravity Master Custom Field For WP Job Manager WordPress plugin (v1.3 and below). It allows attackers to run scripts in the browser of anyone who clicks a crafted link. Update your plugins and always sanitize input!

👉 Stay safe, keep your software updated, and always watch for these common bugs in WordPress plugins.

*This post is an exclusive overview on CVE-2025-22294 for security education and awareness. For the latest details and patch, always check the official plugin page and trusted CVE references.*

Timeline

Published on: 01/07/2025 16:15:41 UTC