Vulnerability · Published Oct 12, 2026 · Assigned by WPScan

CVE-2025-15703WP Job Openings < 4.0.0 - Admin+ Stored XSS

Low 3.5

In plain English

A low-severity cross-site scripting in HireZoot from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).

Severity (CVSS 3.1)3.5Low

Exploit odds (30 days)0.1%top 96.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings before it is reflected back into an admin-area settings page, allowing users with the HireZoot WordPress plugin before 4.0.0's management capability (Administrator by default) to store a payload that is executed in the browser of any administrator who later opens that page. As the unfiltered_html capability is not available to administrators on multisite (or where DISALLOW_UNFILTERED_HTML is set), this leads to Stored Cross-Site Scripting.

Affected products (as reported)

Vendor	Product	Versions
Unknown	HireZoot	0 – before 4.0.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

References

https://wpscan.com/vulnerability/d973da56-ab33-4a8d-bace-4a5f11442cf1/ exploit, vdb-entry, technical-description