HireZoot WordPress Plugin EUVD-2026-107064

Exploitation requires a WordPress account with at least the Author role on the target site that runs HireZoot before 4.1.1 - this is the key limiting factor, making it an insider/low-trust-user privilege escalation rather than a fully anonymous attack. The payload is injected into one of the plugin's stored data fields which is not sanitised/escaped and whose HTML-entity encoding is actively reversed by the plugin. Execution additionally depends on user interaction: a logged-in administrator must view the affected admin dashboard page where the stored data is rendered. No special non-default plugin configuration is indicated beyond having the vulnerable version installed and untrusted Author-level users present.

This is a moderate-risk, not top-priority, vulnerability. The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H, 6.8) is internally inconsistent with the description in two ways. First, PR:H conflicts with the stated prerequisite that only the low-privileged 'Author' role is needed - Author is a legitimate low-trust contributor role, so PR:L is the more defensible choice, which actually RAISES exploitability relative to PR:H. Second, C:H/I:H/A:H is an aggressive rating for a reflected-into-admin stored XSS; NVD-style scoring for XSS is typically C:L/I:L/A:N with a scope change (S:C) to reflect code executing in the victim admin's browser context. The exploitation signals are mixed-to-moderate: a public PoC exists (WPScan), which lowers the barrier to weaponization, but there is NO CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation - PoC availability is not the same as in-the-wild use. Net: a credible, patchable privilege-escalation-via-XSS path (Author → admin takeover) that matters where untrusted Author accounts exist, but the niche plugin footprint and lack of KEV/EPSS data keep it below critical-priority. No SSVC decision data was supplied.

An attacker who holds (or phishes/registers into) a WordPress Author account submits content containing a crafted payload into one of the plugin's stored fields; because the plugin fails to sanitise the value and additionally undoes HTML-entity encoding, the script is stored verbatim. When an administrator later views the affected area of the admin dashboard, the script executes in their authenticated session, enabling account takeover or site compromise. A public proof-of-concept exists (WPScan), lowering the effort to reproduce.