wpmudev Hustle – Email Marketing, Lead Generation, Optins, Popups

• CVE-2026-109386 Medium 4.3 Hustle <= 7.8.14.3 - Missing Authorization to Authenticated (Custom+) ESP Credential Overwrite and Irreversible OAuth Token Deletion via 'hustle_provider_migrate_hubspot' (and sibling migrate_*) AJAX Action 0.4%
• CVE-2026-118169 Medium 4.9 Hustle <= 7.8.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'cta_label' Parameter 0.2%
• CVE-2026-107710 Medium 6.4 Hustle <= 7.8.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Content Title 0.2%
• CVE-2026-2263 Medium 5.3 Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.10.2 - Missing Authorization to Unauthenticated Conversion Tracking Data Manipulation 0.4%
• CVE-2026-0911 High 7.5 Hustle <= 7.8.9.2 - Authenticated (Subscriber+) Arbitrary File Upoload via Module Import 0.6%
• CVE-2024-10580 Medium 5.3 Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.5 - Missing Authorization to Unauthorized Form Submission 0.4%
• CVE-2024-10579 Medium 4.3 Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.5 - Missing Authorization to Unpublished Form Exposure 0.4%
• CVE-2024-0368 High 8.6 Hustle <= 7.8.3 - Sensitive Information Exposure via Exposed Hubspot API Keys 0.8%