CVE-2024-0368

CVE-2024-0368 Hustle Plugin = 7.8.3 contains hardcoded HubSpot API credentials in inc/providers/hubspot/hustle-hubspot-api.php Vulnerability Summary Field| Value ---|--- CVE ID| CVE-2024-0368 Title| Hustle = 7.8.3 - Sensitive Information Exposure via Exposed HubSpot API Keys CVSS Score| 8.6 High...

CVE-2026-109386

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.8.14.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-109386

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to an authorization bypass in all versions up to and including 7.8.14.3 . The root cause is a failure to properly verify user authorization when performing specific actions. An authenticated attacker ...

CVE-2026-109386 Hustle <= 7.8.14.3 - Missing Authorization to Authenticated (Custom+) ESP Credential Overwrite and Irreversible OAuth Token Deletion via 'hustle_provider_migrate_hubspot' (and sibling migrate_*) AJAX Action

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.8.14.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

EUVD-2026-114616

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.8.14.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-0911

CVE-2026-0911 — Hustle Module Import PoC A research / pentest helper tool that tests the upload behavior via the authenticated module import endpoint for the WordPress plugin Hustle wordpress-popup, WPMU DEV under CVE-2026-0911. The CVE-2026-0911.py script in this repository or file set should on...

CVE-2026-109386: wpmudev: The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to authorization…

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.8.14.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

PT-2026-134443

Name of the Vulnerable Software and Affected Versions The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress versions prior to 7.8.15 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific...

WordPress Hustle – Email Marketing, Lead Generation, Optins, Popups plugin <= 7.8.14.3 - Missing Authorization to Authenticated (Custom+) ESP Credential Overwrite and Irreversible OAuth Token Deletion vulnerability

Missing Authorization to Authenticated Custom+ ESP Credential Overwrite and Irreversible OAuth Token Deletion vulnerability discovered by Ekene Umegakwe in WordPress Plugin Hustle versions = 7.8.14.3...

WordPress Hustle – Email Marketing, Lead Generation, Optins, Popups plugin <= 7.8.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Hustle versions = 7.8.14.3...

CVE-2026-118169

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'contentctalabel' parameter in all versions up to, and including, 7.8.14.3 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-107710

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'contenttitle' parameter in all versions up to, and including, 7.8.14.3 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-111613

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'contentctalabel' parameter in all versions up to, and including, 7.8.14.3 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-118169

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 7.8.14.3 . The flaw exists because of insufficient input sanitization and output escaping of the 'content[cta_label]' parameter...

CVE-2026-118169 Hustle <= 7.8.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'cta_label' Parameter

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'contentctalabel' parameter in all versions up to, and including, 7.8.14.3 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-107710

The Hustle WordPress plugin (versions up to and including 7.8.14.3 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping of the 'content[title]' parameter. An authenticated attacker with custom-level access and above can injec...

EUVD-2026-111605

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'contenttitle' parameter in all versions up to, and including, 7.8.14.3 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-107710 Hustle <= 7.8.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Content Title

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'contenttitle' parameter in all versions up to, and including, 7.8.14.3 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-107710 Hustle <= 7.8.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Content Title

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'contenttitle' parameter in all versions up to, and including, 7.8.14.3 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-127886

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'contentcta label' parameter in all versions up to, and including, 7.8.14.3 due to insufficient input sanitization and output escaping. This makes it possible fo...