Live › vulnerability › CVE-2026-118169
Go to dashboardThe Hustle email marketing and popup plugin for WordPress does not sanitize the content[cta_label] parameter, so a logged-in user with the right capability can store a script. The script runs in the browser of any visitor who opens the page where the injected content appears.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 07:31 UTC. All times on this page are UTC.
Sites running Hustle 7.8.14.3 or earlier are affected. Exploitation by a low-privilege user requires the administrator to have delegated to that role; by default only Administrators can use it. Sites that run a current Hustle release or that restrict that capability to Administrators have less exposure.
hustle_edit_moduleNo product ranges from the sources yet.
wp plugin get hustle --field=versionhustle_edit_module was granted to roles below Administrator7.8.14.3hustle_edit_module capability from lower roles such as Subscriber until the update is appliedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content[cta_label]' parameter in all versions up to, and including, 7.8.14.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default only Administrators hold the hustle_edit_module capability, but the plugin's built-in Permissions screen allows administrators to delegate this capability to lower roles including Subscriber, enabling Subscriber-level exploitation on sites where that delegation has been configured.
This page as .md · .json · in your agent: get_signal("CVE-2026-118169")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.