# Hustle <= 7.8.14.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Module Import

- **ID:** WPSEC-2026-2544
- **Plugin:** Hustle – Email Marketing, Lead Generation, Optins, Popups (`wordpress-popup`), https://wordpress.org/plugins/wordpress-popup/
- **Affected versions:** all versions before 7.8.14.5
- **Fixed in:** 7.8.14.5 (Update to 7.8.14.5 or later.)
- **Severity:** Medium 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-05)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wordpress-popup
- **Fix released:** 2026-11-04
- **Published:** 2026-11-05
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2544/

## Description

The Hustle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the module import feature in all versions up to, and including, 7.8.14.4. This is due to imported module meta settings being saved without the sanitization that applies to regular module saves. This makes it possible for authenticated attackers whose role an administrator has given Hustle edit access to a module (any role, including Subscriber, can be given this access) to import a crafted JSON file into that module. Scripts in the file, for example in the module's main content, are stored and execute in the browser of anyone who views the module.

## References

- https://wpsec.com/vuln/WPSEC-2026-2544/
- https://plugins.svn.wordpress.org/wordpress-popup/tags/7.8.14.5/
- https://wordpress.org/plugins/wordpress-popup/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2544/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.