Vulnerability · Published Oct 21, 2026 · Assigned by WPScan
CVE-2026-107790WP Job Openings < 4.1.1 - Author+ Stored XSS via Job Title
Medium 6.8
In plain English
A medium-severity cross-site scripting in HireZoot from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).
Official description
The HireZoot WordPress plugin before 4.1.1 does not sanitise and escape some of its stored data before outputting it in the admin dashboard, and additionally reverses the HTML-entity encoding that would otherwise neutralise it, allowing users with the Author role to perform Stored Cross-Site Scripting attacks that execute in the context of a logged-in administrator.
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
References
- https://wpscan.com/vulnerability/4bec1d97-9ab1-4ce7-b108-dcc2a0d9a934/ exploit, vdb-entry, technical-description