CVE-2024-0368

The Hustle plugin for WordPress (wordpress-popup) versions up to and including 7.8.3 contains hardcoded HubSpot credentials in inc/providers/hubspot/hustle-hubspot-api.php (CLIENT_ID, CLIENT_SECRET, HAPIKEY). This root cause enables exposure of HubSpot API keys and potential access to PII via Hub...

CVE-2024-8492

The Hustle WordPress plugin (≤ 7.8.5) is vulnerable to Admin+ Stored XSS due to insufficient sanitisation/escaping of certain settings, enabling high-privilege users (e.g., editors) to execute scripts even with unfiltered_html disallowed. Impact is limited to XSS within the plugin context; no exp...