What’s Vulnerable › Products
wpmudev Hustle – Email Marketing, Lead Generation, Optins, Popups vulnerabilities
10 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 9 published in the last 12 months.
Latest wpmudev Hustle – Email Marketing, Lead Generation, Optins, Popups vulnerabilities
- CVE-2026-109386 — Hustle <= 7.8.14.3 - Missing Authorization to Authenticated (Custom+) ESP Credential Overwrite and Irreversible OAuth Token Deletion via 'hustle_provider_migrate_hubspot' (and sibling migrate_*) AJAX Action (CVSS 4.3)
- CVE-2026-118169 — Hustle <= 7.8.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'cta_label' Parameter (CVSS 4.9)
- CVE-2026-107710 — Hustle <= 7.8.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Content Title (CVSS 6.4)
- CVE-2026-80440 — Hustle < 7.8.14.2 - Unauthenticated Arbitrary Shortcode Execution via Success Message Placeholders (CVSS 4.8)
- CVE-2026-2263 — Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.10.2 - Missing Authorization to Unauthenticated Conversion Tracking Data Manipulation (CVSS 5.3)
- CVE-2026-0911 — Hustle <= 7.8.9.2 - Authenticated (Subscriber+) Arbitrary File Upoload via Module Import (CVSS 7.5)
- CVE-2024-8492 — Hustle < 7.8.5 - Admin+ Stored XSS (CVSS 4.8)
- CVE-2024-10580 — Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.5 - Missing Authorization to Unauthorized Form Submission (CVSS 5.3)
- CVE-2024-10579 — Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.5 - Missing Authorization to Unpublished Form Exposure (CVSS 4.3)
- CVE-2024-0368 — Hustle <= 7.8.3 - Sensitive Information Exposure via Exposed Hubspot API Keys (CVSS 8.6)