CVE-2019-11872

The Hustle (WordPress Hustle/wordpress-popup) plugin, version 6.0.7 for WordPress, is vulnerable to CSV Injection due to unsanitized user input in pop-ups. This can enable injection of malicious content into Excel, potentially allowing execution of code on an administrator’s machine. Documents co...

CVE-2018-18576

The CVE-2018-18576 entry concerns The Hustle (aka wordpress-popup) WordPress plugin up to version 6.0.5. Affected component: the plugin’s handling of requests to views/admin/dashboard/. Root cause: directory traversal allows obtaining a directory listing. Impact: potential disclosure of restricte...