CVE-2026-107710: Hustle <= 7.8.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Content Title

Q: Is a default Hustle installation affected by this attack path?

The vulnerable versions are affected, but exploitation depends on a non-default permission change. An administrator must explicitly grant the Hustle “Create and Update Modules” capability (hustle_create or hustle_edit_module) to the attacker’s role through Settings → Permissions.

Q: What level of access does an attacker need?

The attacker must be authenticated and have custom-level access or higher, along with the delegated Hustle module creation or editing capability. No user interaction is required from the attacker once a malicious module title has been saved.

Q: Who is at risk from a stored payload?

Any user who accesses a page containing the injected module can trigger execution of the stored script in their browser. The issue can affect confidentiality and integrity, while no availability impact is stated.

Q: How can I determine whether my site is exposed?

Check whether Hustle is version 7.8.14.3 or earlier, and review Hustle Settings → Permissions for roles that have been granted hustle_create or hustle_edit_module. Sites that have not delegated those capabilities through this feature do not meet the stated exploitation requirement.

Published Oct 28, 2026

Updated

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content[title]' parameter in all versions up to, and including, 7.8.14.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has explicitly granted the 'Create and Update Modules' (hustlecreate / hustleeditmodule) capability to the attacker's role via the plugin's own Settings → Permissions feature; this delegation is not enabled by default.

Affected Software

1 affected component

Hustle Hustle – Email Marketing, Lead Generation, Optins, Popups<=7.8.14.3

Event History

Oct 28, 2026

CVE Published

via MITRE·06:45 AM

Data Sourced

via MITRE·06:45 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Is a default Hustle installation affected by this attack path?

The vulnerable versions are affected, but exploitation depends on a non-default permission change. An administrator must explicitly grant the Hustle “Create and Update Modules” capability (hustle_create or hustle_edit_module) to the attacker’s role through Settings → Permissions.

What level of access does an attacker need?

The attacker must be authenticated and have custom-level access or higher, along with the delegated Hustle module creation or editing capability. No user interaction is required from the attacker once a malicious module title has been saved.

Who is at risk from a stored payload?

Any user who accesses a page containing the injected module can trigger execution of the stored script in their browser. The issue can affect confidentiality and integrity, while no availability impact is stated.

How can I determine whether my site is exposed?

Check whether Hustle is version 7.8.14.3 or earlier, and review Hustle Settings → Permissions for roles that have been granted hustle_create or hustle_edit_module. Sites that have not delegated those capabilities through this feature do not meet the stated exploitation requirement.

CVE-2026-107710: Hustle <= 7.8.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Content Title

Affected Software

Event History

Frequently Asked Questions

Is a default Hustle installation affected by this attack path?

What level of access does an attacker need?

Who is at risk from a stored payload?

How can I determine whether my site is exposed?

Company

Resources

Contact

Frequently Asked Questions

Is a default Hustle installation affected by this attack path?

What level of access does an attacker need?

Who is at risk from a stored payload?

How can I determine whether my site is exposed?