CyberRota Analysis
AI-GeneratedThe HireZoot WordPress plugin versions prior to 4.0.0 are vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient sanitization of job specification settings, allowing attackers with administrative access to inject malicious scripts. This vulnerability can lead to the execution of arbitrary scripts in the browsers of administrators who access the affected settings page. WordPress site administrators using the HireZoot plugin should prioritize updating to version 4.0.0 or later to mitigate this risk.
Original NVD Description
The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings before it is reflected back into an admin-area settings page, allowing users with the HireZoot WordPress plugin before 4.0.0's management capability (Administrator by default) to store a payload that is executed in the browser of any administrator who later opens that page. As the unfiltered_html capability is not available to administrators on multisite (or where DISALLOW_UNFILTERED_HTML is set), this leads to Stored Cross-Site Scripting.