{
 "id": "WPSEC-2026-2544",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2544/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2544/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2544/index.md",
 "title": "Hustle <= 7.8.14.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Module Import",
 "description": "The Hustle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the module import feature in all versions up to, and including, 7.8.14.4. This is due to imported module meta settings being saved without the sanitization that applies to regular module saves. This makes it possible for authenticated attackers whose role an administrator has given Hustle edit access to a module (any role, including Subscriber, can be given this access) to import a crafted JSON file into that module. Scripts in the file, for example in the module's main content, are stored and execute in the browser of anyone who views the module.",
 "plugin": {
  "slug": "wordpress-popup",
  "name": "Hustle",
  "full_name": "Hustle – Email Marketing, Lead Generation, Optins, Popups",
  "wordpress_org": "https://wordpress.org/plugins/wordpress-popup/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wordpress-popup/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wordpress-popup"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "7.8.14.5",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 7.8.14.5"
  ]
 },
 "introduced_in": null,
 "fixed_in": "7.8.14.5",
 "remediation": "Update to 7.8.14.5 or later.",
 "fix_released": "2026-11-04T07:27:01+00:00",
 "published": "2026-11-05T07:45:42+00:00",
 "updated": "2026-11-04T13:57:18.737121+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2544/",
  "https://plugins.svn.wordpress.org/wordpress-popup/tags/7.8.14.5/",
  "https://wordpress.org/plugins/wordpress-popup/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wordpress-popup",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-05"
 }
}