CVE-2025-15703: WP Job Openings < 4.0.0 - Admin+ Stored XSS
The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings before it is reflected back into an admin-area settings page, allowing users with the HireZoot WordPress plugin before 4.0.0's management capability (Administrator by default) to store a payload that is executed in the browser of any administrator who later opens that page. As the unfilteredhtml capability is not available to administrators on multisite (or where DISALLOWUNFILTEREDHTML is set), this leads to Stored Cross-Site Scripting.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue under the default WordPress role configuration?
A user who has the HireZoot plugin's management capability can exploit it. By default, this capability is available to WordPress administrators.
When does the stored payload execute?
The payload executes in the browser of an administrator who later opens the affected admin-area settings page.
Are all WordPress deployments equally affected?
The issue leads to stored XSS where the user cannot use the unfiltered_html capability, such as on WordPress multisite installations or when DISALLOW_UNFILTERED_HTML is set.