The HireZoot WordPress plugin before version 4.1.1 does not sanitize and escape certain stored data, and it reverses HTML-entity encoding that would normally neutralise malicious input. This flaw allows a user with the Author role to inject and store JavaScript that is later rendered in the admin dashboard, executing in the context of a logged‑in administrator.

WordPress sites that have the HireZoot plugin installed in any version earlier than 4.1.1 are affected. This includes any site where Authors have permission to edit job titles or related content within the plugin’s interface.

The vulnerability has a CVSS score of 6.8, an EPSS score of < 1%, and it is not listed in the CISA KEV catalog. Exploitation requires an authenticated Author‑role user, which is a common permission on many sites. Execution of the injected script occurs in the browser of a logged‑in administrator, enabling the attacker to run arbitrary code within the admin context. The threat level is moderate and the attack is straightforward through the job title field without needing further privileges.