Live › vulnerability › CVE-2026-107710
Go to dashboardThe Hustle WordPress plugin does not sanitize the 'content[title]' parameter, so text stored through it is later rendered without escaping. An authenticated user with the granted Hustle module capability can inject scripts that run in the browser of anyone who opens the injected page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 07:31 UTC. All times on this page are UTC.
Sites running Hustle 7.8.14.3 or earlier where the site owner has granted the Create and Update Modules capability to a non-administrator role through the plugin's Permissions settings. The capability is not granted by default, so sites that only have administrators managing Hustle are less exposed. Sites that do not run Hustle can skip it.
No product ranges from the sources yet.
wp plugin get hustle --field=version, and compare it against the fixed release.7.8.14.3; the fixed version is unknown from the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content[title]' parameter in all versions up to, and including, 7.8.14.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has explicitly granted the 'Create and Update Modules' (hustle_create / hustle_edit_module) capability to the attacker's role via the plugin's own Settings → Permissions feature; this delegation is not enabled by default.
This page as .md · .json · in your agent: get_signal("CVE-2026-107710")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.