CVE-2026-80440CWE-74
CVE-2026-80440
Medium · published September 9, 2026
What it is
The Hustle WordPress plugin before 7.8.14.2 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into the message it returns after submission, because the guard it applies can be defeated by nesting, allowing unauthenticated users to run any shortcode registered on the site.
The record
Technical detail
- CVSS v3.1
- 4.8 · MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.00243 · 14.6th percentile
- Weakness
- CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
- Published
- 2026-09-09T11:16Z
References (1)
EPSS history
Timeline