CVE-2026-107790: WP Job Openings < 4.1.1 - Author+ Stored XSS via Job Title
The HireZoot WordPress plugin before 4.1.1 does not sanitise and escape some of its stored data before outputting it in the admin dashboard, and additionally reverses the HTML-entity encoding that would otherwise neutralise it, allowing users with the Author role to perform Stored Cross-Site Scripting attacks that execute in the context of a logged-in administrator.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue, and who is affected by the resulting script execution?
A user with the WordPress Author role can exploit the issue by storing malicious content in a job title. The payload executes in the browser context of a logged-in administrator when it is rendered in the admin dashboard.
Which versions require remediation?
HireZoot WP Job Openings versions earlier than 4.1.1 are affected. Updating to version 4.1.1 or later addresses the affected version range described.
How can I assess whether my site may be exposed?
Check whether HireZoot WP Job Openings is installed at a version earlier than 4.1.1 and whether untrusted users hold the Author role. Review job titles and related stored job data for unexpected HTML or script-like content, particularly if administrators have viewed the plugin's dashboard.