Hustle <= 7.8.14.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Module Import
- ID
- WPSEC-2026-2544
- Plugin
- Hustle – Email Marketing, Lead Generation, Optins, Popups (wordpress-popup)
- Affected
- all versions before 7.8.14.5
- Remediation
- Update to 7.8.14.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-05
- Attack surface
- Hustle on WPSec AttackSurface
- Fix released
- Published
Description
The Hustle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the module import feature in all versions up to, and including, 7.8.14.4. This is due to imported module meta settings being saved without the sanitization that applies to regular module saves. This makes it possible for authenticated attackers whose role an administrator has given Hustle edit access to a module (any role, including Subscriber, can be given this access) to import a crafted JSON file into that module. Scripts in the file, for example in the module's main content, are stored and execute in the browser of anyone who views the module.
References
- https://wpsec.com/vuln/WPSEC-2026-2544/
- https://plugins.svn.wordpress.org/wordpress-popup/tags/7.8.14.5/
- https://wordpress.org/plugins/wordpress-popup/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS