Stored Cross-Site Scripting Vulnerability in HireZoot WordPress Plugin
CVE-2025-15703
Key Information:
Badges
What is CVE-2025-15703?
The HireZoot WordPress plugin prior to version 4.0.0 contains a vulnerability where it fails to properly sanitize and escape job specification settings when reflected back on an admin-area settings page. This flaw allows users with management capabilities, typically administrators, to store malicious payloads. When an affected admin accesses the settings page, the payload gets executed in their browser, posing a significant security risk. This vulnerability is particularly critical in multisite environments or where specific settings, such as DISALLOW_UNFILTERED_HTML, are enforced.
Affected Version(s)
HireZoot 0 < 4.0.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.