CVE-2025-15703 is a Stored Cross-Site Scripting vulnerability in WP Job Openings before version 4.0.0. The plugin, a job-listing and recruitment tool installed on more than 30,000 sites (it is now distributed on WordPress.org as HireZoot – Job Listings, Career Page & Recruitment Tool), does not sanitize and escape one of its job specification settings — the Icon field — before printing it back on its own settings page. A user with the plugin’s management capability, which is Administrator by default, can store a payload that runs in the browser of any administrator who later opens that page. It matters on WordPress Multisite and on sites with DISALLOW_UNFILTERED_HTML, where administrators are not allowed to post raw HTML. The issue is fixed in 4.0.0.
| CVE | CVE-2025-15703 |
| Plugin Version | WP Job Openings < 4.0.0, fixed in 4.0.0 |
| All Time | 725 012 |
| Active installations | 30 000+ |
| Publicly Published | October 10, 2026 |
| Last Updated | October 10, 2026 |
| Researcher | Krugov Artyom |
| CWE | CWE-79 Cross-Site Scripting |
| PoC | Yes |
| Exploit | No |
| Reference | https://www.cve.org/CVERecord?id=CVE-2025-15703 https://wpscan.com/vulnerability/d973da56-ab33-4a8d-bace-4a5f11442cf1/ |
| Plugin Security Certification by CleanTalk |  |
| Logo of the plugin |  |
PSC by CleantalkJoin the community of developers who prioritize security. Highlight your plugin in the WordPress catalog.
Timeline
| June 27, 2025 | Plugin testing and vulnerability detection in WP Job Openings were completed. |
| June 27, 2025 | The vulnerability report was sent with the PoC, technical description, and recommendations for remediation. |
| May 6, 2026 | The vendor released version 4.0.0, the version listed as containing the fix. |
| October 10, 2026 | WPScan publicly published the advisory for CVE-2025-15703. |
Discovery of the Vulnerability
While auditing the settings of the WP Job Openings plugin, I found that the Job Specifications screen (Job Openings → Settings → Job Specifications) lets a specification carry an Icon value, submitted as the awsm_jobs_filter[0][icon] parameter. The value is saved as typed and later written into an HTML attribute of the icon selector on the same settings page without sanitizing on input or escaping on output. A value that closes the attribute with a quote can therefore add new attributes of its own, including event handlers, and it is stored in the database so it fires every time the page is opened — a persistent (Stored) XSS.
Understanding of Stored Cross-Site Scripting attacks
Stored (persistent) Cross-Site Scripting keeps the attacker’s payload on the server so it is served automatically to whoever opens the affected page. This case needs a high-privilege account, which is why the issue is rated Low (CVSS 3.5): on a standard single site an administrator already holds the unfiltered_html capability and can post raw HTML anyway. The risk becomes real on WordPress Multisite and on sites that set DISALLOW_UNFILTERED_HTML, where administrators do not hold it: missing output escaping lets them bypass that restriction and run JavaScript in the session of other administrators.
The plugin also creates an HR-style role for recruiters. Any user holding the plugin’s management capability, not only full administrators, can reach the vulnerable settings, so the audience able to plant the payload is wider than the word “Admin” suggests.
Exploiting the Stored Cross-Site Scripting Vulnerability
To reproduce the vulnerability on an affected version (below 4.0.0):
- Use a site where administrators cannot post raw HTML: WordPress Multisite, or a single site with
DISALLOW_UNFILTERED_HTMLset totrue. - Log in as an Administrator (or any user with the plugin’s job management capability) and open the Job Openings plugin tab.
- Go to Settings, then Job Specifications.
- Insert the XSS payload into the Icon field (the
awsm_jobs_filter[0][icon]parameter) and save the settings. - Reopen Job Specifications and move the mouse over the rendered element — the payload executes.
PoC:
POC:
Account - Administrator, or any user with the plugin's job management capability, on a site where
administrators cannot post raw HTML (WordPress Multisite, or DISALLOW_UNFILTERED_HTML set to true)
1) Go to the Job Openings plugin tab and open Settings.
2) Go to Job Specifications.
3) Insert the payload below into the Icon field (parameter awsm_jobs_filter[0][icon]) and save the settings:
123" tabindex=0 onmouseover=alert(888) style=display:block;width:100px;height:100px;background:red; x="
4) Reopen Job Specifications. The payload renders a red box in the icon selector.
5) Move the mouse over the red box: the onmouseover handler executes alert(888).The payload closes the attribute the stored value is printed into and adds tabindex, onmouseover and style attributes. The style makes the element a 100×100 red box, so there is something to hover over, and alert(888) runs in the context of the admin page. In a real attack the harmless alert() would be replaced with code that creates a rogue administrator or steals the session, and it fires for every administrator who opens the settings page afterwards.
Recommendations for Improved Security
To mitigate CVE-2025-15703:
- Update the plugin to version 4.0.0 or later; the current release is newer still and is now published as HireZoot.
- Sanitize specification fields on input and escape them on output with
esc_attr()— an icon identifier should be validated against a list of allowed values, not accepted as free text. - Do not treat the administrator or HR role as a trust boundary for HTML, especially on Multisite and with
DISALLOW_UNFILTERED_HTML. - Review who holds the plugin’s management capability and remove it from accounts that do not need it; protect those accounts with 2FA.
- Implement a strong Content Security Policy (CSP) to block inline JavaScript execution.
- Deploy a Web Application Firewall to filter XSS payloads before they reach the application.
To prevent this type of attack, follow our methods of XSS prevention.
By addressing Stored XSS vulnerabilities like CVE-2025-15703 early, WordPress site owners and plugin developers can protect administrators and entire networks from account takeover. Stay vigilant, stay secure.
#WordPressSecurity #StoredXSS #WPJobOpenings #WebsiteSafety #StayProtected
Use CleanTalk solutions to improve the security of your website
Krugov Artyom
