Hello,

Plugin: Job Manager 0.7.24 https://wordpress.org/plugins/job-manager/

1. Reflected Cross-Site Scripting (XSS) 

Authenticated administrators can inject html/js code (there is no CSRF protection!).

Method: GET

Url: http://localhost/wp-admin/admin.php?page=jobman-list-applications&jobman-rating=[xss]

Vulnerable parameters: jobman-rating

Example PHP callstack:

jobman_list_applications   [/job-manager/admin-applications.php:95]

jobman_print_rating_stars   [/job-manager/functions.php:60]

Verification: