Hustle EUVD-2026-111605

Exploitation requires an authenticated account whose role has been explicitly granted the plugin's 'Create and Update Modules' capability (hustle_create / hustle_edit_module) by an administrator via Settings → Permissions; this delegation is NOT enabled by default, so standard installs without delegated roles are not exploitable by non-admins. The injection point is the 'content[title]' parameter of a Hustle module, which is stored and later rendered without adequate sanitization/output escaping. Limiting factors: authenticated access is mandatory (not anonymous), the capability delegation is non-default and admin-controlled, and realistic impact depends on another user subsequently viewing the injected content.

This is a legitimately moderate issue rather than a drop-everything emergency, and the signals are internally consistent. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, base 6.4) describes a network-reachable, low-complexity stored XSS that requires authentication (PR:L) and whose scope is changed (S:C) because injected script executes in the browsers of other users. There is no CISA KEV listing and no EPSS score in the supplied data, and no public exploit is referenced, so there is nothing indicating active or imminent mass exploitation. The vuln.today decision label is 'this_month', which aligns with a real-but-not-urgent priority. The most important risk-reducing factor is not in the CVSS score at all: exploitation requires that an administrator has explicitly delegated the 'Create and Update Modules' (hustle_create / hustle_edit_module) capability to a lower-privileged role through the plugin's Settings → Permissions, and that delegation is off by default - so in a default install the realistic attacker population is empty. Net: a real priority to patch within the normal cycle, but its practical reach is gated by a non-default privilege delegation, making it lower real-world risk than the 6.4 base score alone suggests for most deployments.

In a site where an administrator has granted a custom or contributor-type role the Hustle 'Create and Update Modules' capability, an authenticated user holding that role submits a module whose 'content[title]' parameter contains a malicious script payload, which is stored without sufficient sanitization. When another user - such as an administrator reviewing modules or a visitor loading an affected page - renders that content, the script executes in their browser session (scope-changed impact). No public exploit code is referenced in the available data; a Wordfence advisory and the fixing source changeset are the only linked artifacts.