Live › vulnerability › CVE-2026-107790
Go to dashboardThe HireZoot WordPress plugin before 4.1.1 stores some data without sanitising or escaping it, and then outputs it in the admin dashboard. An author-role user can plant script that runs in the browser of a logged-in administrator.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the HireZoot WordPress plugin before 4.1.1 where users with the Author role can create or edit data the plugin displays in the admin dashboard. Sites without this plugin, or where no untrusted users hold Author accounts, have less exposure.
No product ranges from the sources yet.
4.1.1 are affectedwp plugin get hirezoot --field=version if WP-CLI is available4.1.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The HireZoot WordPress plugin before 4.1.1 does not sanitise and escape some of its stored data before outputting it in the admin dashboard, and additionally reverses the HTML-entity encoding that would otherwise neutralise it, allowing users with the Author role to perform Stored Cross-Site Scripting attacks that execute in the context of a logged-in administrator.
This page as .md · .json · in your agent: get_signal("CVE-2026-107790")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.