Hustle CVE-2026-118169

Requires an authenticated WordPress account possessing the hustle_edit_module capability, which by default is granted only to Administrators. The attacker injects the payload through the 'content[cta_label]' parameter when creating/editing a Hustle module. Subscriber- or other low-privilege-level exploitation is possible ONLY on sites where an administrator has used the plugin's built-in Permissions screen to delegate hustle_edit_module to lower roles - a non-default configuration that is the primary limiting factor. Secondary limiting factor: the stored script only fires when a user actually loads a page that renders the affected module. Where no delegation exists, exploitation is effectively limited to Administrator-level accounts, substantially reducing real-world risk.

This is a moderate, low-urgency issue rather than a top priority. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N, base 4.9 Medium) describes a network-reachable but authenticated (PR:L) stored XSS with only Low confidentiality and integrity impact and a scope change. Crucially, exploitation requires the hustle_edit_module capability, which by default is held only by Administrators; lower roles (down to Subscriber) can exploit it ONLY where an administrator has explicitly delegated that capability through the plugin's Permissions screen - a non-default configuration. The vuln.today decision label is 'this_month', not act_now/emergency, consistent with the moderate severity. No EPSS score, no CISA KEV listing, and no public exploit code were provided in the input, so there is no signal of active or widespread exploitation. The references are the Wordfence advisory and WordPress trac source lines (code locations for the sink and the fix), not a working exploit. Bottom line: a genuine but bounded stored-XSS requiring an authenticated account with a specific capability; priority is appropriately 'this month' for sites running the plugin, higher only where the capability has been delegated to untrusted low-privilege users.

An authenticated user holding the hustle_edit_module capability (an Administrator by default, or a lower role such as Subscriber on sites where an admin delegated that capability) edits a Hustle module and injects a malicious script into the 'content[cta_label]' field. The payload is stored and then executes in the browser of any user who subsequently views a page rendering that module, allowing session/token theft or actions in the victim's context. No public exploit code was identified at time of analysis; the trac references point only to the vulnerable renderer/model code, not a weaponized PoC.