CVE-2026-80440: CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in Hustle

The Hustle WordPress plugin before version 7.8.14.2 fails to prevent shortcode execution in submitted form values due to improper neutralization of special elements (CWE-74). The plugin attempts to guard against shortcode execution but this can be bypassed by nesting shortcodes, allowing unauthenticated attackers to run arbitrary shortcodes registered on the site. This vulnerability affects version 7.0.0.1 as explicitly stated. No official patch or remediation level is currently provided in the available data.

An unauthenticated attacker can execute any shortcode registered on the WordPress site by submitting specially crafted form values. This can lead to limited confidentiality and integrity impacts as indicated by the CVSS vector (C:L/I:L/A:N). The vulnerability does not allow privilege escalation or denial of service but may enable unauthorized content manipulation or information disclosure depending on the shortcodes available on the site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or restricting the use of shortcodes in form submissions or applying custom input sanitization to prevent shortcode execution. Monitor vendor channels for updates and apply any official patches once released.