Stored Cross-Site Scripting in HireZoot WordPress Plugin
CVE-2026-107790
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-107790?
The HireZoot WordPress plugin prior to version 4.1.1 suffers from a vulnerability where it fails to properly sanitize and escape stored data before displaying it in the admin dashboard. This oversight, combined with the reversal of HTML-entity encoding, permits users with Author permissions to launch Stored Cross-Site Scripting attacks. Consequently, these attacks can execute script code within the browser context of an actively logged-in administrator, posing a significant risk to site security.
Affected Version(s)
HireZoot 0 < 4.1.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.