The vulnerability allows an authenticated attacker with the capability to create or edit modules to store malicious JavaScript in the Module Content Title field. Because the plugin does not properly sanitize or escape this input, the script is rendered and executed by any user who views the affected page, leading to cross‑site scripting on a page in the victim’s browser. This class of flaw lets an attacker execute arbitrary code in the context of the site’s users, enabling phishing, cookie theft, or defacement. The weakness is classified as CWE‑79.

WordPress sites running the Hustle email, lead generation, opt‑in, and popup plugin from wpmudev, version 7.8.14.3 or earlier. The flaw is present in all releases up to and including this version and requires that an attacker’s role be granted the "Create and Update Modules" capability, typically available to Contributors and higher when the plugin’s Permissions settings are enabled.

The CVSS score of 6.4 indicates a moderate severity impact. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user who has been delegated module creation or editing rights via the plugin’s Settings → Permissions feature. Once that privilege is granted, attackers can inject trusted scripts that will run for any visitor accessing the injected module page. Because this privilege delegation is not enabled by default, the risk is limited to environments where admins have explicitly expanded Contributor capabilities.