Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2024-8492 (GCVE-0-2024-8492)

Vulnerability from nvd – Published: 2025-05-15 20:07 – Updated: 2025-05-17 03:12

Title

Hustle < 7.8.5 - Admin+ Stored XSS

Summary

The Hustle WordPress plugin through 7.8.5 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

Severity

4.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-05-17 03:12 UTC

CWE

CWE-79 Cross-Site Scripting (XSS)

Assigner

WPScan CNA under the mitre root

CNA scorecard E 44/100 over 1703 records in the last 180 days details

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/c7437eba-8e91-4f…	exploitvdb-entrytechnical-description

Impacted products

1 product

Vendor	Product	Version
Unknown	Hustle	Affected: 0 , ≤ 7.8.5 (semver)

Credits

Dmitrii Ignatyev WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.8,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "HIGH",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-8492",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-17T03:12:26.239606Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-17T03:12:46.151Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Hustle",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThanOrEqual": "7.8.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Dmitrii Ignatyev"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Hustle  WordPress plugin through 7.8.5 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-79 Cross-Site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-15T20:07:15.763Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/c7437eba-8e91-4fcc-82a3-ff8908b36877/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Hustle \u003c 7.8.5 - Admin+ Stored XSS",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2024-8492",
    "datePublished": "2025-05-15T20:07:15.763Z",
    "dateReserved": "2024-09-05T17:32:09.018Z",
    "dateUpdated": "2025-05-17T03:12:46.151Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-10580 (GCVE-0-2024-10580)

Vulnerability from nvd – Published: 2024-11-27 06:41 – Updated: 2026-04-08 16:47

Title

Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.5 - Missing Authorization to Unauthorized Form Submission

Summary

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to unauthorized form submissions due to a missing capability check on the submit_form() function in all versions up to, and including, 7.8.5. This makes it possible for unauthenticated attackers to submit unpublished forms.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-11-27 14:34 UTC

CWE

CWE-862 - Missing Authorization

Assigner

Wordfence CNA under the mitre root

CNA scorecard C 65/100 over 2304 records in the last 180 days details

References

3 references

URL	Tags
https://www.wordfence.com/threat-intel/vulnerabil…
https://plugins.trac.wordpress.org/browser/wordpr…
https://plugins.trac.wordpress.org/changeset/3196…

Impacted products

2 products

Vendor	Product	Version
wpmudev	Hustle – Email Marketing, Lead Generation, Optins, Popups	Affected: 0 , ≤ 7.8.5 (semver)
wpmudev	hustle	Affected: 0 , ≤ 7.8.5 (semver) cpe:2.3:a:wpmudev:hustle::::::::

Credits

Vijaysimha Reddy

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:wpmudev:hustle:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "hustle",
            "vendor": "wpmudev",
            "versions": [
              {
                "lessThanOrEqual": "7.8.5",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-10580",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-27T14:34:24.997950Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-27T14:40:32.667Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Hustle \u2013 Email Marketing, Lead Generation, Optins, Popups",
          "vendor": "wpmudev",
          "versions": [
            {
              "lessThanOrEqual": "7.8.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Vijaysimha Reddy"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Hustle \u2013 Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to unauthorized form submissions due to a missing capability check on the submit_form() function in all versions up to, and including, 7.8.5. This makes it possible for unauthenticated attackers to submit unpublished forms."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T16:47:08.620Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3b2f8726-c4c4-4ed6-aa8d-4412cf5be061?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wordpress-popup/tags/7.8.5/inc/front/hustle-module-front-ajax.php#L251"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3196639/wordpress-popup/tags/7.8.6/inc/front/hustle-module-front-ajax.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-11-26T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Hustle \u2013 Email Marketing, Lead Generation, Optins, Popups \u003c= 7.8.5 - Missing Authorization to Unauthorized Form Submission"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2024-10580",
    "datePublished": "2024-11-27T06:41:28.378Z",
    "dateReserved": "2024-10-31T12:57:12.812Z",
    "dateUpdated": "2026-04-08T16:47:08.620Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-0368 (GCVE-0-2024-0368)

Vulnerability from nvd – Published: 2024-03-13 15:27 – Updated: 2026-04-08 17:30

Title

Hustle <= 7.8.3 - Sensitive Information Exposure via Exposed Hubspot API Keys

Summary

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.8.3 via hardcoded API Keys. This makes it possible for unauthenticated attackers to extract sensitive data including PII.

Severity

8.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-08-02 20:38 UTC

CWE

CWE-522 - Insufficiently Protected Credentials

Assigner

Wordfence CNA under the mitre root

CNA scorecard C 65/100 over 2304 records in the last 180 days details

References

5 references

URL	Tags
https://www.wordfence.com/threat-intel/vulnerabil…
https://plugins.trac.wordpress.org/browser/wordpr…
https://developers.hubspot.com/docs/api/webhooks#scopes
https://developers.hubspot.com/docs/api/webhooks#…
https://plugins.trac.wordpress.org/changeset/3047…

Impacted products

2 products

Vendor	Product	Version
wpmudev	Hustle – Email Marketing, Lead Generation, Optins, Popups	Affected: 0 , ≤ 7.8.3 (semver)
wpmudev	hustle	Affected: 0 , ≤ 7.8.3 (semver) cpe:2.3:a:wpmudev:hustle::::::::

Credits

Sean Murphy

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T18:04:49.506Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e6d40b41-540d-476d-afde-970845543933?source=cve"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/browser/wordpress-popup/trunk/inc/providers/hubspot/hustle-hubspot-api.php#L13"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://developers.hubspot.com/docs/api/webhooks#scopes"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://developers.hubspot.com/docs/api/webhooks#manage-settings-via-api"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/changeset/3047775/wordpress-popup/trunk/inc/providers/hubspot/hustle-hubspot-api.php?old=3025070\u0026old_path=wordpress-popup/tags/7.8.3/inc/providers/hubspot/hustle-hubspot-api.php"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:wpmudev:hustle:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "hustle",
            "vendor": "wpmudev",
            "versions": [
              {
                "lessThanOrEqual": "7.8.3",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-0368",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-02T20:38:25.301715Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-02T20:39:27.616Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Hustle \u2013 Email Marketing, Lead Generation, Optins, Popups",
          "vendor": "wpmudev",
          "versions": [
            {
              "lessThanOrEqual": "7.8.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Sean Murphy"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Hustle \u2013 Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.8.3 via hardcoded API Keys. This makes it possible for unauthenticated attackers to extract sensitive data including PII."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-522",
              "description": "CWE-522 Insufficiently Protected Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T17:30:15.925Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e6d40b41-540d-476d-afde-970845543933?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wordpress-popup/trunk/inc/providers/hubspot/hustle-hubspot-api.php#L13"
        },
        {
          "url": "https://developers.hubspot.com/docs/api/webhooks#scopes"
        },
        {
          "url": "https://developers.hubspot.com/docs/api/webhooks#manage-settings-via-api"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3047775/wordpress-popup/trunk/inc/providers/hubspot/hustle-hubspot-api.php?old=3025070\u0026old_path=wordpress-popup/tags/7.8.3/inc/providers/hubspot/hustle-hubspot-api.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-03-12T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Hustle \u003c= 7.8.3 - Sensitive Information Exposure via Exposed Hubspot API Keys"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2024-0368",
    "datePublished": "2024-03-13T15:27:21.681Z",
    "dateReserved": "2024-01-09T19:55:46.479Z",
    "dateUpdated": "2026-04-08T17:30:15.925Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-8492 (GCVE-0-2024-8492)

Vulnerability from cvelistv5 – Published: 2025-05-15 20:07 – Updated: 2025-05-17 03:12

Title

Hustle < 7.8.5 - Admin+ Stored XSS

Summary

The Hustle WordPress plugin through 7.8.5 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

Severity

4.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-05-17 03:12 UTC

CWE

CWE-79 Cross-Site Scripting (XSS)

Assigner

WPScan CNA under the mitre root

CNA scorecard E 44/100 over 1703 records in the last 180 days details

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/c7437eba-8e91-4f…	exploitvdb-entrytechnical-description

Impacted products

1 product

Vendor	Product	Version
Unknown	Hustle	Affected: 0 , ≤ 7.8.5 (semver)

Credits

Dmitrii Ignatyev WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.8,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "HIGH",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-8492",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-17T03:12:26.239606Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-17T03:12:46.151Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Hustle",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThanOrEqual": "7.8.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Dmitrii Ignatyev"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Hustle  WordPress plugin through 7.8.5 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-79 Cross-Site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-15T20:07:15.763Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/c7437eba-8e91-4fcc-82a3-ff8908b36877/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Hustle \u003c 7.8.5 - Admin+ Stored XSS",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2024-8492",
    "datePublished": "2025-05-15T20:07:15.763Z",
    "dateReserved": "2024-09-05T17:32:09.018Z",
    "dateUpdated": "2025-05-17T03:12:46.151Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-10580 (GCVE-0-2024-10580)

Vulnerability from cvelistv5 – Published: 2024-11-27 06:41 – Updated: 2026-04-08 16:47

Title

Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.5 - Missing Authorization to Unauthorized Form Submission

Summary

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to unauthorized form submissions due to a missing capability check on the submit_form() function in all versions up to, and including, 7.8.5. This makes it possible for unauthenticated attackers to submit unpublished forms.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-11-27 14:34 UTC

CWE

CWE-862 - Missing Authorization

Assigner

Wordfence CNA under the mitre root

CNA scorecard C 65/100 over 2304 records in the last 180 days details

References

3 references

URL	Tags
https://www.wordfence.com/threat-intel/vulnerabil…
https://plugins.trac.wordpress.org/browser/wordpr…
https://plugins.trac.wordpress.org/changeset/3196…

Impacted products

2 products

Vendor	Product	Version
wpmudev	Hustle – Email Marketing, Lead Generation, Optins, Popups	Affected: 0 , ≤ 7.8.5 (semver)
wpmudev	hustle	Affected: 0 , ≤ 7.8.5 (semver) cpe:2.3:a:wpmudev:hustle::::::::

Credits

Vijaysimha Reddy

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:wpmudev:hustle:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "hustle",
            "vendor": "wpmudev",
            "versions": [
              {
                "lessThanOrEqual": "7.8.5",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-10580",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-27T14:34:24.997950Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-27T14:40:32.667Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Hustle \u2013 Email Marketing, Lead Generation, Optins, Popups",
          "vendor": "wpmudev",
          "versions": [
            {
              "lessThanOrEqual": "7.8.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Vijaysimha Reddy"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Hustle \u2013 Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to unauthorized form submissions due to a missing capability check on the submit_form() function in all versions up to, and including, 7.8.5. This makes it possible for unauthenticated attackers to submit unpublished forms."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T16:47:08.620Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3b2f8726-c4c4-4ed6-aa8d-4412cf5be061?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wordpress-popup/tags/7.8.5/inc/front/hustle-module-front-ajax.php#L251"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3196639/wordpress-popup/tags/7.8.6/inc/front/hustle-module-front-ajax.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-11-26T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Hustle \u2013 Email Marketing, Lead Generation, Optins, Popups \u003c= 7.8.5 - Missing Authorization to Unauthorized Form Submission"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2024-10580",
    "datePublished": "2024-11-27T06:41:28.378Z",
    "dateReserved": "2024-10-31T12:57:12.812Z",
    "dateUpdated": "2026-04-08T16:47:08.620Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-0368 (GCVE-0-2024-0368)

Vulnerability from cvelistv5 – Published: 2024-03-13 15:27 – Updated: 2026-04-08 17:30

Title

Hustle <= 7.8.3 - Sensitive Information Exposure via Exposed Hubspot API Keys

Summary

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.8.3 via hardcoded API Keys. This makes it possible for unauthenticated attackers to extract sensitive data including PII.

Severity

8.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-08-02 20:38 UTC

CWE

CWE-522 - Insufficiently Protected Credentials

Assigner

Wordfence CNA under the mitre root

CNA scorecard C 65/100 over 2304 records in the last 180 days details

References

5 references

URL	Tags
https://www.wordfence.com/threat-intel/vulnerabil…
https://plugins.trac.wordpress.org/browser/wordpr…
https://developers.hubspot.com/docs/api/webhooks#scopes
https://developers.hubspot.com/docs/api/webhooks#…
https://plugins.trac.wordpress.org/changeset/3047…

Impacted products

2 products

Vendor	Product	Version
wpmudev	Hustle – Email Marketing, Lead Generation, Optins, Popups	Affected: 0 , ≤ 7.8.3 (semver)
wpmudev	hustle	Affected: 0 , ≤ 7.8.3 (semver) cpe:2.3:a:wpmudev:hustle::::::::

Credits

Sean Murphy

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T18:04:49.506Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e6d40b41-540d-476d-afde-970845543933?source=cve"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/browser/wordpress-popup/trunk/inc/providers/hubspot/hustle-hubspot-api.php#L13"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://developers.hubspot.com/docs/api/webhooks#scopes"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://developers.hubspot.com/docs/api/webhooks#manage-settings-via-api"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/changeset/3047775/wordpress-popup/trunk/inc/providers/hubspot/hustle-hubspot-api.php?old=3025070\u0026old_path=wordpress-popup/tags/7.8.3/inc/providers/hubspot/hustle-hubspot-api.php"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:wpmudev:hustle:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "hustle",
            "vendor": "wpmudev",
            "versions": [
              {
                "lessThanOrEqual": "7.8.3",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-0368",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-02T20:38:25.301715Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-02T20:39:27.616Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Hustle \u2013 Email Marketing, Lead Generation, Optins, Popups",
          "vendor": "wpmudev",
          "versions": [
            {
              "lessThanOrEqual": "7.8.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Sean Murphy"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Hustle \u2013 Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.8.3 via hardcoded API Keys. This makes it possible for unauthenticated attackers to extract sensitive data including PII."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-522",
              "description": "CWE-522 Insufficiently Protected Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T17:30:15.925Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e6d40b41-540d-476d-afde-970845543933?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wordpress-popup/trunk/inc/providers/hubspot/hustle-hubspot-api.php#L13"
        },
        {
          "url": "https://developers.hubspot.com/docs/api/webhooks#scopes"
        },
        {
          "url": "https://developers.hubspot.com/docs/api/webhooks#manage-settings-via-api"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3047775/wordpress-popup/trunk/inc/providers/hubspot/hustle-hubspot-api.php?old=3025070\u0026old_path=wordpress-popup/tags/7.8.3/inc/providers/hubspot/hustle-hubspot-api.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-03-12T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Hustle \u003c= 7.8.3 - Sensitive Information Exposure via Exposed Hubspot API Keys"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2024-0368",
    "datePublished": "2024-03-13T15:27:21.681Z",
    "dateReserved": "2024-01-09T19:55:46.479Z",
    "dateUpdated": "2026-04-08T17:30:15.925Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

6 vulnerabilities found for hustle by wpmudev

CVE-2024-8492 (GCVE-0-2024-8492)

CVE-2024-10580 (GCVE-0-2024-10580)

CVE-2024-0368 (GCVE-0-2024-0368)

CVE-2024-8492 (GCVE-0-2024-8492)

CVE-2024-10580 (GCVE-0-2024-10580)

CVE-2024-0368 (GCVE-0-2024-0368)