Stored Cross-Site Scripting in Hustle Email Marketing Plugin by WordPress

CVE-2026-107710

What is CVE-2026-107710?

The Hustle - Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping in the 'content[title]' parameter. This vulnerability enables authenticated attackers with custom-level permissions or higher to inject malicious web scripts into pages. These scripts execute whenever a user accesses the compromised page. It is essential to note that for exploitation to occur, an admin must grant specific permissions ('Create and Update Modules') to the attacker's role through the plugin's settings, which is not enabled by default.

References