CVE-2026-118169: Hustle <= 7.8.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'cta_label' Parameter
The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content[ctalabel]' parameter in all versions up to, and including, 7.8.14.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default only Administrators hold the hustleeditmodule capability, but the plugin's built-in Permissions screen allows administrators to delegate this capability to lower roles including Subscriber, enabling Subscriber-level exploitation on sites where that delegation has been configured.
Affected Software
Event History
Frequently Asked Questions
Which users can realistically exploit this issue?
An attacker must be authenticated and have the hustle_edit_module capability. By default, this capability is limited to Administrators; Subscriber-level exploitation is possible only if an administrator delegated the capability through Hustle's Permissions screen.
Are default Hustle role permissions affected?
The vulnerable code is present through version 7.8.14.3, but default permissions limit module editing to Administrators. Sites that have not delegated hustle_edit_module to lower roles do not expose the described Subscriber-level attack path.
What access is required for an injected script to run?
The attacker needs authenticated access with permission to edit Hustle modules and must inject script through the content[cta_label] parameter. The stored script executes when a user visits a page containing the injected content.