CVE-2026-107790

Deferred Deferred - Pending Action

Stored XSS in HireZoot WordPress Plugin

Publication date: 2026-10-21

Last updated on: 2026-10-21

Assigner: WPScan

Description

The HireZoot WordPress plugin before 4.1.1 does not sanitise and escape some of its stored data before outputting it in the admin dashboard, and additionally reverses the HTML-entity encoding that would otherwise neutralise it, allowing users with the Author role to perform Stored Cross-Site Scripting attacks that execute in the context of a logged-in administrator.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-21

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-107790

EUVD

EUVD-2026-107064

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	HireZoot	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a Stored Cross-Site Scripting (XSS) vulnerability in the HireZoot WordPress plugin before version 4.1.1. It allows users with the Author role to inject malicious scripts via the Job Title field. The plugin fails to sanitize and escape stored data before displaying it in the admin dashboard and reverses HTML-entity encoding, which would otherwise neutralize the attack.

Detection Guidance

Check if the HireZoot WordPress plugin version is below 4.1.1. Log in as an administrator and inspect the admin dashboard for unexpected scripts or unusual behavior in the Job Title field. Review stored data in the plugin's database tables for unescaped or malformed HTML entities.

Impact Analysis

An attacker with Author role privileges could execute malicious scripts in the context of a logged-in administrator. This could lead to unauthorized actions, data theft, or further compromise of the WordPress site.

Compliance Impact

This vulnerability allows unauthorized script execution in admin dashboards, potentially enabling attackers to steal sensitive data or manipulate admin sessions. Such breaches could violate GDPR by exposing personal data or HIPAA by compromising protected health information if exploited in healthcare environments.

Mitigation Strategies

Update the HireZoot WordPress plugin to version 4.1.1 or later immediately. If updating is not possible, disable the plugin temporarily until an update is applied. Restrict Author role permissions to limit their ability to modify Job Title fields.

Hi! I’m here to help you understand CVE-2026-107790. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...