Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-107710EUVD-2026-111605GHSA-W4W7-H5XV-23GR

Hustle <= 7.8.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Content Title

Published
Last modified
published
Not listed in CISA KEV
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: partial

Summary

The Hustle plugin for WordPress, a tool for email marketing, lead generation, opt-ins, and popups, is affected. An authenticated user with permission to create or edit modules can inject malicious scripts that run in the browser of anyone who views the affected page, which could allow session hijacking or actions taken on behalf of other users.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Read the original description

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content[title]' parameter in all versions up to, and including, 7.8.14.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has explicitly granted the 'Create and Update Modules' (hustle_create / hustle_edit_module) capability to the attacker's role via the plugin's own Settings → Permissions feature; this delegation is not enabled by default.

Timeline

  1. CVE published
  2. First seen by cve.now
  3. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: partial

  4. Record last updated

Affected versions

  • wpmudev Hustle – Email Marketing, Lead Generation, Optins, Popups

    through 7.8.14.3

References 7

wordfence.com

plugins.trac.wordpress.org