Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · wp-job-openings
HireZoot
4 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 21, 2026HireZoot: Does not sanitise and escape some of its stored data before outputting it in the admin dashboardCVE-2026-107790 · fixed in 4.1.1 · reported by WPScanMedium 6.8
The HireZoot WordPress plugin before 4.1.1 does not sanitise and escape some of its stored data before outputting it in the admin dashboard, and additionally reverses the HTML-entity encoding that would otherwise neutralise it, allowing users with the Author role to perform Stored Cross-Site Scripting attacks that execute in the context of a logged-in administrator.
Oct 12, 2026HireZoot: Does not sanitise and escape one of its job specification settings before it is reflected back into an admin-area settings pageCVE-2025-15703 · fixed in 4.0.0 · reported by WPScanLow 3.5
The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings before it is reflected back into an admin-area settings page, allowing users with the HireZoot WordPress plugin before 4.0.0's management capability (Administrator by default) to store a payload that is executed in the browser of any administrator who later opens that page. As the unfiltered_html capability is not available to administrators on multisite (or where DISALLOW_UNFILTERED_HTML is set), this leads to Stored Cross-Site Scripting.
Jan 2, 2025WP Job Openings: Missing AuthorizationCVE-2023-45061 · affects up to 3.4.1 · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in awsm.in WP Job Openings wp-job-openings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Openings: from n/a through <= 3.4.1.
Oct 16, 2023WP Job Openings: Does not block listing the contents of the directories where it stores attachments to job applicationsCVE-2023-4933 · fixed in 3.4.3 · reported by WPScanMedium 5.3
The WP Job Openings WordPress plugin before 3.4.3 does not block listing the contents of the directories where it stores attachments to job applications, allowing unauthenticated visitors to list and download private attachments if the autoindex feature of the web server is enabled.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.