{"id":"CVE-2026-107790","kind":"vulnerability","aliases":["CVE-2026-107790"],"related":[],"title":"HireZoot WordPress plugin: stored XSS lets authors attack administrators","description":"The HireZoot  WordPress plugin before 4.1.1 does not sanitise and escape some of its stored data before outputting it in the admin dashboard, and additionally reverses the HTML-entity encoding that would otherwise neutralise it, allowing users with the Author role to perform Stored Cross-Site Scripting attacks that execute in the context of a logged-in administrator.","summary":"The HireZoot WordPress plugin before 4.1.1 stores some data without sanitising or escaping it, and then outputs it in the admin dashboard. An author-role user can plant script that runs in the browser of a logged-in administrator.","severity":"medium","cvss":6.8,"epss":0.00317,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hirezoot","package","wordpress","wordpress-plugin"],"not_affected_if":["no-author-accounts","plugin-not-installed"],"how_to_check":"- Check the installed HireZoot plugin version in the WordPress admin Plugins screen; versions below `4.1.1` are affected\n- `wp plugin get hirezoot --field=version` if WP-CLI is available","fix":"- Update the HireZoot plugin to `4.1.1` or later\n- Review Author-role accounts and recent HireZoot data entries for injected script if the plugin was exposed","status":"open","published_at":"2026-10-21T06:16:47+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T03:42:58+00:00","updated_at":"2026-10-25T03:42:58+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:42:58Z","model":"claude-haiku-5-5","output":{"fix":"- Update the HireZoot plugin to `4.1.1` or later\n- Review Author-role accounts and recent HireZoot data entries for injected script if the plugin was exposed","reach":"internet","title":"HireZoot WordPress plugin: stored XSS lets authors attack administrators","impact":"high","summary":"The HireZoot WordPress plugin before 4.1.1 stores some data without sanitising or escaping it, and then outputs it in the admin dashboard. An author-role user can plant script that runs in the browser of a logged-in administrator.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","hirezoot"],"confidence":0.7,"needs_auth":"yes","worst_case":"Administrator session hijacked through script running in admin dashboard","analyst_note":"","how_to_check":"- Check the installed HireZoot plugin version in the WordPress admin Plugins screen; versions below `4.1.1` are affected\n- `wp plugin get hirezoot --field=version` if WP-CLI is available","needs_analyst":false,"not_affected_if":["plugin-not-installed","no-author-accounts"],"who_is_affected":"Sites running the HireZoot WordPress plugin before 4.1.1 where users with the Author role can create or edit data the plugin displays in the admin dashboard. Sites without this plugin, or where no untrusted users hold Author accounts, have less exposure.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000605,"input_tokens":3386,"output_tokens":533,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-107790':12A,15A '-2026':11A,14A '4.1.1':27B,68C 'addit':87C 'admin':42B,84C 'administr':9A,62B,123C 'allow':99C 'attack':8A,112C 'author':7A,46B,103C 'author-rol':45B 'browser':56B 'context':117C 'cross':109C 'cross-sit':108C 'cve':10A,13A 'dashboard':43B,85C 'data':30B,78C 'encod':93C 'entiti':92C 'escap':34B,73C 'execut':114C 'hirezoot':1A,16B,23B,64C 'html':91C 'html-entiti':90C 'let':6A 'log':60B,121C 'logged-in':59B,120C 'neutralis':97C 'otherwis':96C 'output':38B,80C 'packag':17B 'perform':106C 'plant':50B 'plugin':3A,21B,25B,66C 'revers':88C 'role':47B,104C 'run':53B 'sanitis':32B,71C 'script':51B,111C 'site':110C 'store':4A,28B,77C,107C 'user':48B,100C 'without':31B 'wordpress':2A,18B,20B,24B,65C 'wordpress-plugin':19B 'would':95C 'xss':5A","nicknames":[],"mitigations":[],"who_affected":"Sites running the HireZoot WordPress plugin before 4.1.1 where users with the Author role can create or edit data the plugin displays in the admin dashboard. Sites without this plugin, or where no untrusted users hold Author accounts, have less exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T06:16:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107790","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107790","severity":null,"published_at":"2026-10-21T06:16:47+00:00","modified_at":"2026-10-21T18:37:38+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-107790","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107790","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}