Hirezoot
Monthly
Stored cross-site scripting in the HireZoot WordPress plugin before 4.1.1 allows any account holding the Author role to plant script payloads in plugin data that is later rendered unescaped in the admin dashboard, and the plugin actively reverses the HTML-entity encoding that would otherwise neutralise those payloads. The injected script executes in a logged-in administrator's session once that administrator views the affected dashboard page, giving a low-trust Author-level user a path to admin-context actions; publicly available exploit code exists and the vendor has released 4.1.1 as the fix. Because exploitation requires an existing Author account plus administrator interaction, this is a moderate-risk insider privilege-escalation issue rather than an anonymous remote compromise.
Stored cross-site scripting in the HireZoot WordPress plugin before 4.1.1 allows any account holding the Author role to plant script payloads in plugin data that is later rendered unescaped in the admin dashboard, and the plugin actively reverses the HTML-entity encoding that would otherwise neutralise those payloads. The injected script executes in a logged-in administrator's session once that administrator views the affected dashboard page, giving a low-trust Author-level user a path to admin-context actions; publicly available exploit code exists and the vendor has released 4.1.1 as the fix. Because exploitation requires an existing Author account plus administrator interaction, this is a moderate-risk insider privilege-escalation issue rather than an anonymous remote compromise.