---
id: "CVE-2026-107790"
kind: "vulnerability"
aliases: ["CVE-2026-107790"]
title: "HireZoot WordPress plugin: stored XSS lets authors attack administrators"
severity: "medium"
cvss: 6.8
epss: 0.00317
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["hirezoot", "package", "wordpress", "wordpress-plugin"]
not_affected_if: ["no-author-accounts", "plugin-not-installed"]
published_at: "2026-10-21T06:16:47+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T03:42:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107790", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-107790", "first_seen_at": "2026-10-24T13:15:55+00:00"}]
---

# HireZoot WordPress plugin: stored XSS lets authors attack administrators

The HireZoot WordPress plugin before 4.1.1 stores some data without sanitising or escaping it, and then outputs it in the admin dashboard. An author-role user can plant script that runs in the browser of a logged-in administrator.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed HireZoot plugin version in the WordPress admin Plugins screen; versions below `4.1.1` are affected
- `wp plugin get hirezoot --field=version` if WP-CLI is available

## Fix

- Update the HireZoot plugin to `4.1.1` or later
- Review Author-role accounts and recent HireZoot data entries for injected script if the plugin was exposed

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107790
- 2026-10-24T13:15:55+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-107790

## From the sources

The HireZoot  WordPress plugin before 4.1.1 does not sanitise and escape some of its stored data before outputting it in the admin dashboard, and additionally reverses the HTML-entity encoding that would otherwise neutralise it, allowing users with the Author role to perform Stored Cross-Site Scripting attacks that execute in the context of a logged-in administrator.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_