HireZoot CVE-2025-15703

Attacker must already hold the HireZoot plugin's management capability (Administrator by default) to store the payload in a job specification setting, and a separate administrator must subsequently open the affected admin-area settings page (UI:R) to trigger execution. The flaw is only a meaningful privilege escalation where administrators lack unfiltered_html - specifically WordPress multisite installations or sites where DISALLOW_UNFILTERED_HTML is defined; on default single-site installs admins already have HTML-injection rights, sharply limiting real-world impact. Payload executes in the admin browser context, so impact is confined to actions available to the viewing administrator.

This is a low-priority issue despite being network-reachable. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N, base 3.5) is dominated by two strong mitigating factors: PR:H means the attacker must already hold the plugin's management capability (Administrator by default), and UI:R means a second administrator must independently navigate to the affected settings page for the stored payload to fire. No EPSS score, KEV listing, or public POC was provided in the input, so there is no signal of real-world exploitation - no public exploit identified at time of analysis. The practical attacker-to-victim gap is also narrow: on a standard single-site WordPress install, administrators already hold the unfiltered_html capability and can inject script legitimately, so the flaw is only meaningfully a privilege boundary on multisite installations or where DISALLOW_UNFILTERED_HTML is defined, exactly as the description notes. This is a genuine but low-risk, high-privilege, admin-against-admin stored XSS rather than a widespread threat. No conflicting signals were found; the CVSS vector is consistent with the description.

On a WordPress multisite (or a site with DISALLOW_UNFILTERED_HTML set), a user with the HireZoot management capability saves a malicious script inside a job specification setting. When another administrator later opens that admin settings page, the unsanitised value is reflected into the page and the script executes in their authenticated session. No public exploit code was identified at time of analysis.