Stored Cross‑Site Scripting via missing authorization is possible in the WP JobHunt plugin for WordPress when a candidate or higher user invokes a status update without an authorization check. The attacker can embed arbitrary JavaScript into the status field of a job application, which will execute whenever a user views that application. This can result in session hijacking, defacement, or theft of sensitive data, compromising confidentiality and integrity. The weakness is classified as a missing authorization flaw (CWE‑862).

Affected is the WP JobHunt plugin for WordPress, also used by the JobCareer theme. All versions up to and including 7.7 contain the flaw. Any installation within those version ranges is vulnerable and can be exploited by users with Candidate‑level or higher permissions.

The CVSS score is 7.6, indicating a high severity. The EPSS score is below 1%, suggesting a low likelihood of exploitation in the wild. It is not listed in the CISA KEV catalog. Attackers require an authenticated account with at least Candidate privilege, limiting the threat surface to registered site users. In such environments, the missing authorization allows a malicious candidate to inject XSS payloads into job application status data, achieving client‑side code execution.