WP JobHunt Plugin Missing Capability Check Vulnerability Allowing Stored Cross-Site Scripting

A vulnerability in the WP JobHunt plugin for WordPress, utilized by the JobCareer theme, allows for unauthorized data modification. This issue arises from a lack of proper capability checks in the 'cs_update_application_status_callback' function, affecting all versions up to and including 7.7. The vulnerability enables authenticated attackers with Candidate-level access or higher to inject cross-site scripting (XSS) into the 'status' parameter of job applications, impacting any user.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the job application.