CVE-2026-107710

10th percentile - higher than 10% of all known CVEs

The Hustle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content[title]' parameter in versions up to and including 7.8.14.3 due to insufficient input sanitization and output escaping. An authenticated attacker with custom-level access or higher can inject arbitrary web scripts that execute when a user visits the injected page. Exploitation requires that an administrator has explicitly granted the 'Create and Update Modules' (hustle_create / hustle_edit_module) capability to the attacker's role via the plugin's own Settings → Permissions feature; this delegation is not enabled by default.

An attacker with the appropriate privileges can execute arbitrary JavaScript in users' browsers, potentially leading to session hijacking or actions on behalf of the victim.

Update the Hustle plugin to a version later than 7.8.14.3 and restrict granting of hustle_create/hustle_edit_module capabilities to the minimum necessary.