The WP JobHunt plugin suffers from a missing capability check (CWE-862) in the 'cs_update_application_status_callback' function, which handles updating the status of job applications. Because the function does not properly verify user permissions, authenticated users with Candidate-level access can submit crafted requests that inject cross-site scripting code into the 'status' parameter for any user's job application. This vulnerability affects all versions up to 7.7 and has a CVSS 3.1 base score of 7.6, indicating high severity. There is no vendor advisory or patch information available at this time.

Successful exploitation allows an authenticated attacker with Candidate-level privileges to perform unauthorized modifications to job application statuses, injecting malicious scripts via the 'status' parameter. This can lead to cross-site scripting attacks impacting confidentiality and availability, potentially allowing session hijacking or other malicious actions within the affected WordPress environment. The vulnerability has a high CVSS score (7.6) reflecting significant impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Candidate-level user permissions where possible and monitor for suspicious activity related to job application status updates. Avoid granting unnecessary privileges to authenticated users. Follow vendor channels for updates regarding patches or official mitigations.