CVE-2025-15703

Name of the Vulnerable Software and Affected Versions HireZoot WordPress plugin versions prior to 4.0.0

Description The plugin fails to sanitize and escape a job specification setting before it is reflected on an admin-area settings page. This allows users with management capabilities, such as Administrators, to store a malicious payload that executes in the browser of any administrator viewing the page. This results in Stored Cross-Site Scripting (XSS), a condition where malicious scripts are permanently stored on the target server and served to other users.

Recommendations Update HireZoot WordPress plugin to version 4.0.0 or later.