WordPress plugin
Hustle – Email Marketing, Lead Generation, Optins, Popups security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 15 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High3
- Medium12
- Low0
All Hustle – Email Marketing, Lead Generation, Optins, Popups vulnerabilities
- Medium4.3Missing Authorization to Authenticated (Custom+) ESP Credential Overwrite and Irreversible OAuth Token Deletion via 'hustle_provider_migrate_hubspot' (and sibling migrate_*) AJAX Action
≤7.8.14.3Update to 7.8.14.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Module Content Title
≤7.8.14.3Update to 7.8.14.4
- Medium4.9Authenticated (Subscriber+) Stored Cross-Site Scripting via 'cta_label' Parameter
≤7.8.14.3Update to 7.8.14.4
- Medium4.3Missing Authorization
≤7.8.14.2Update to 7.8.14.3
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
<7.8.14.2Update to 7.8.14.2
- Medium5.3Missing Authorization
≤7.8.10.1Update to 7.8.10.2
- Medium5.3Missing Authorization to Unauthenticated Conversion Tracking Data Manipulation
≤7.8.10.2Update to 7.8.11
- Medium5.3Unauthenticated Information Exposure
≤7.8.9.2Update to 7.8.9.3
- High7.5Authenticated (Subscriber+) Arbitrary File Upoload via Module Import
≤7.8.9.2Update to 7.8.9.3
- Medium5.3Missing Authorization to Unauthorized Form Submission
≤7.8.5Update to 7.8.6
- Medium4.3Missing Authorization to Unpublished Form Exposure
≤7.8.5Update to 7.8.6
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤7.8.4Update to 7.8.5
- High8.6Sensitive Information Exposure via Exposed Hubspot API Keys
≤7.8.3Update to 7.8.4
- Medium4.4Hustle <= 7.6.4 = Authenticated (Administrator+) Stored Cross-Site Scripting
≤7.6.4Update to 7.6.6
- High7.8Unauthenticated CSV Injection
≤6.0.7Update to 6.0.8.1
Hustle – Email Marketing, Lead Generation, Optins, Popups: common questions
Does Hustle – Email Marketing, Lead Generation, Optins, Popups have known vulnerabilities?
Yes. VulnCrest Radar lists 15 known vulnerabilities in Hustle – Email Marketing, Lead Generation, Optins, Popups: 3 high, 12 medium. None are known to affect version null.
How do I check which version of Hustle – Email Marketing, Lead Generation, Optins, Popups I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Hustle – Email Marketing, Lead Generation, Optins, Popups vulnerability?
CVE-2026-109386, published Oct 30, 2026: Hustle <= 7.8.14.3 - Missing Authorization to Authenticated (Custom+) ESP Credential Overwrite and Irreversible OAuth Token Deletion via 'hustle_provider_migrate_hubspot' (and sibling migrate_*) AJAX Action. Severity: Medium (CVSS 4.3).
Is any Hustle – Email Marketing, Lead Generation, Optins, Popups vulnerability listed in CISA KEV?
No. None of the known Hustle – Email Marketing, Lead Generation, Optins, Popups vulnerabilities is currently listed in the CISA KEV catalog.