Threats tagged 'ghsa-h7rh-wh4h-735q'

The Hustle WordPress plugin, used for email marketing and lead generation, is vulnerable to stored cross-site scripting (XSS) via the 'content[cta_label]' parameter in all versions up to and including 7.8.14.3. This vulnerability arises from insufficient input sanitization and output escaping, allowing authenticated users with custom-level access or higher to inject malicious scripts. By default, only administrators have the required capability, but this can be delegated to lower roles such as Subscribers, potentially enabling exploitation by less privileged users.