The HireZoot plugin for WordPress versions earlier than 4.0.0 fails to sanitize a job specification input before displaying it on an administrative settings page. This flaw allows a user with managerial privileges—typically an Administrator—to store JavaScript that runs in the browsers of any administrator who later visits that settings screen. The stored payload is executed in the context of the admin user, potentially enabling session hijacking, defacement, or execution of arbitrary code within the site’s administrative interface.

Any WordPress installation that has the HireZoot plugin installed with a version older than 4.0.0 is affected. The vulnerability exists in all such releases and is not limited to a particular sub‑release or deployment scenario. Administrators of these sites, regardless of whether the site is single‑site or multisite, could trigger the flaw if they have the capability to modify plugin settings.

The flaw is a form of stored Cross‑Site Scripting that requires the presence of an administrator to inject the payload. Because the attack vector is confined to privileged accounts, the likelihood of widespread exploitation is lower than a generic public entry point. The CVSS score is 3.5, indicating low severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, but the inherent risk of arbitrary code execution in the admin console warrants prompt mitigation.