Hey - Nice Site.

I noticed the below vuln because you currently aren't filtering inputs sufficiently. The validation looked weak as it was rendering html, so I did a bit of testing and found you can run javascript hidden in an image tag like the below:

<IMG """><SCRIPT>alert("XSS")</SCRIPT>"\>

You can see this running on the below:

https://www.careerfair.io/reviews/test

I suspect if I put this in the job name it might actually run the javascript when anyone visits the homepage?