Threats tagged 'ghsa-w4w7-h5xv-23gr'

The Hustle plugin for WordPress, used for email marketing and lead generation, contains a stored cross-site scripting (XSS) vulnerability in the 'content[title]' parameter. This affects all versions up to and including 7.8.14.3. The flaw arises from insufficient input sanitization and output escaping, allowing authenticated users with custom-level access and the 'Create and Update Modules' capability to inject malicious scripts. This capability is not granted by default and must be explicitly assigned by an administrator via the plugin's permissions settings.