Stored Cross-Site Scripting in SendPulse Email Marketing Plugin for WordPress

CVE-2026-13362

What is CVE-2026-13362?

The SendPulse Email Marketing Newsletter plugin for WordPress suffers from a Stored Cross-Site Scripting vulnerability due to inadequate input sanitization and output escaping. This issue affects all versions up to and including 2.2.5, allowing authenticated users with contributor-level access or higher to inject malicious web scripts via the _sp_form_code Post Meta. By creating a sendpulse_form post that includes a legitimate SendPulse loader script tag with additional malicious HTML, an attacker can bypass security measures and execute scripts in the browsers of any user, including administrators, viewing the page that renders the [sendpulse-form] shortcode.

References