What is GHSA-rf7x-rwhg-53vc?

GHSA-rf7x-rwhg-53vc is a security advisory published by GitHub Security Advisories with Medium severity. The Hustle WordPress plugin before 7.8.14.2 does not prevent shortcodes in submitted form values...

Which CVE IDs does GHSA-rf7x-rwhg-53vc cover?

GHSA-rf7x-rwhg-53vc covers the following CVE IDs: CVE-2026-80440. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-rf7x-rwhg-53vc?

GHSA-rf7x-rwhg-53vc has a CVSS v3 base score of 4.8, published by GitHub Security Advisories.

GHSA-rf7x-rwhg-53vcMediumCVSS 4.8

The Hustle WordPress plugin before 7.8.14.2 does not prevent shortcodes in submitted form values...

Vendor

GitHub Security Advisories

Published

September 9, 2026

Last Modified

September 9, 2026

🔗 CVE IDs covered (1)

CVE-2026-80440 →

📋 Description

The Hustle WordPress plugin before 7.8.14.2 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into the message it returns after submission, because the guard it applies can be defeated by nesting, allowing unauthenticated users to run any shortcode registered on the site.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-80440
https://wpscan.com/vulnerability/7b86b462-e021-4906-bbf3-bf83f89a03ee
https://github.com/advisories/GHSA-rf7x-rwhg-53vc