118 matches found
CVE-2024-0368
CVE-2024-0368 Hustle Plugin = 7.8.3 contains hardcoded HubSpot API credentials in inc/providers/hubspot/hustle-hubspot-api.php Vulnerability Summary Field| Value ---|--- CVE ID| CVE-2024-0368 Title| Hustle = 7.8.3 - Sensitive Information Exposure via Exposed HubSpot API Keys CVSS Score| 8.6 High...
CVE-2026-0911
CVE-2026-0911 — Hustle Module Import PoC A research / pentest helper tool that tests the upload behavior via the authenticated module import endpoint for the WordPress plugin Hustle wordpress-popup, WPMU DEV under CVE-2026-0911. The CVE-2026-0911.py script in this repository or file set should on...
CVE-2026-103075
Missing Authorization vulnerability in WPMU DEV Hustle wordpress-popup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hustle: from n/a through 7.8.14.2...
CVE-2026-103075 WordPress Hustle plugin <= 7.8.14.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in WPMU DEV Hustle wordpress-popup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hustle: from n/a through 7.8.14.2...
EUVD-2026-94251
Missing Authorization vulnerability in WPMU DEV Hustle wordpress-popup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hustle: from n/a through 7.8.14.2...
CVE-2026-103075
The Hustle WordPress plugin (specifically the wordpress-popup component) versions up to and including 7.8.14.2 is vulnerable to a Broken Access Control issue. The root cause is a Missing Authorization vulnerability (CWE-862), which allows for the exploitation of incorrectly configured access cont...
CVE-2026-103075 WordPress Hustle plugin <= 7.8.14.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in WPMU DEV Hustle wordpress-popup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hustle: from n/a through 7.8.14.2...
WordPress Hustle plugin <= 7.8.14.2 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Dustin Lange in WordPress Plugin Hustle versions = 7.8.14.2...
PT-2026-107454
Missing Authorization vulnerability in WPMU DEV Hustle wordpress-popup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hustle: from n/a through 7.8.14.2...
CVE-2026-80440
The Hustle WordPress plugin before 7.8.14.2 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into the message it returns after submission, because the guard it applies can be defeated by nesting, allowing unauthenticated users to run any...
EUVD-2026-74722
The Hustle WordPress plugin before 7.8.14.2 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into the message it returns after submission, because the guard it applies can be defeated by nesting, allowing unauthenticated users to run any...
CVE-2026-80440 Hustle < 7.8.14.2 - Unauthenticated Arbitrary Shortcode Execution via Success Message Placeholders
The Hustle WordPress plugin before 7.8.14.2 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into the message it returns after submission, because the guard it applies can be defeated by nesting, allowing unauthenticated users to run any...
CVE-2026-80440
Hustle is a WordPress plugin for lead generation and email marketing. Versions prior to 7.8.14.2 are affected by an unauthenticated arbitrary shortcode execution vulnerability. When a user submits a form, the plugin substitutes submitted values into a success message. The guard it applies to prev...
CVE-2026-80440 Hustle < 7.8.14.2 - Unauthenticated Arbitrary Shortcode Execution via Success Message Placeholders
The Hustle WordPress plugin before 7.8.14.2 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into the message it returns after submission, because the guard it applies can be defeated by nesting, allowing unauthenticated users to run any...
WordPress Hustle plugin < 7.8.14.2 - Unauthenticated Arbitrary Shortcode Execution vulnerability
Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Jakub Herman in WordPress Plugin Hustle versions 7.8.14.2...
PT-2026-88879
The Hustle WordPress plugin before 7.8.14.2 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into the message it returns after submission, because the guard it applies can be defeated by nesting, allowing unauthenticated users to run any...
CVE-2026-80440: Improper Neutralization of Special Elements in Output Used by a Downstream Component
The Hustle WordPress plugin before 7.8.14.2 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into the message it returns after submission, because the guard it applies can be defeated by nesting, allowing unauthenticated users to run any...
CVE-2026-25431
Missing Authorization vulnerability in WPMU DEV Hustle allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Hustle: through 7.8.10.1...
CVE-2026-2263
The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'hustlemoduleconverted' AJAX action in all versions up to, and including, 7.8.10.2. This makes it possible for...