CVE-2025-15703: CWE-79 Cross-Site Scripting (XSS) in HireZoot

The HireZoot WordPress plugin prior to version 4.0.0 contains a stored Cross-Site Scripting (CWE-79) vulnerability. The flaw is due to insufficient sanitization and escaping of a job specification setting before it is rendered in an admin settings page. Users with management capabilities can inject malicious scripts that execute in the browsers of administrators who access the affected page. This vulnerability is exploitable in environments where administrators do not have the unfiltered_html capability, such as multisite WordPress installations or when DISALLOW_UNFILTERED_HTML is set.

An attacker with management privileges in the HireZoot plugin can inject malicious JavaScript that executes in the context of other administrators viewing the affected settings page. This can lead to session hijacking, privilege escalation, or other malicious actions performed with administrator privileges. The vulnerability affects the confidentiality and integrity of the administrator's session and potentially the entire WordPress site.

Upgrade the HireZoot WordPress plugin to version 4.0.0 or later, where this vulnerability is fixed. Since no official patch link is provided, check the vendor's advisory or plugin repository for the update. Until patched, restrict management capabilities to trusted users only and avoid opening the affected settings page if possible.