---
id: "CVE-2026-107710"
kind: "vulnerability"
aliases: ["CVE-2026-107710"]
title: "Hustle WordPress plugin: stored XSS via content title parameter"
severity: "medium"
cvss: 6.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wordpress-plugins"]
not_affected_if: ["auth-required", "default-config"]
published_at: "2026-10-28T07:16:43+00:00"
first_seen_at: "2026-10-28T07:31:37+00:00"
updated_at: "2026-10-28T07:33:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107710", "first_seen_at": "2026-10-28T07:31:37+00:00"}]
---

# Hustle WordPress plugin: stored XSS via content title parameter

The Hustle WordPress plugin does not sanitize the 'content[title]' parameter, so text stored through it is later rendered without escaping. An authenticated user with the granted Hustle module capability can inject scripts that run in the browser of anyone who opens the injected page.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Hustle version in the plugin list or `wp plugin get hustle --field=version`, and compare it against the fixed release.
- In the plugin's Settings, Permissions tab, check whether any custom role has 'Create and Update Modules' (hustle_create / hustle_edit_module) granted.

## Fix

- Update the Hustle plugin to a release newer than `7.8.14.3`; the fixed version is unknown from the sources.
- Remove the hustle_create / hustle_edit_module capability from roles that do not need it until updated.

## Timeline

- 2026-10-28T07:31:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107710

## From the sources

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content[title]' parameter in all versions up to, and including, 7.8.14.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has explicitly granted the 'Create and Update Modules' (hustle_create / hustle_edit_module) capability to the attacker's role via the plugin's own Settings → Permissions feature; this delegation is not enabled by default.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_