CVE-2026-13362 in Email Marketing Newsletter Plugin
Summary
by MITRE • 08/01/2026
The SendPulse Email Marketing Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via _sp_form_code Post Meta in all versions up to, and including, 2.2.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the attacker to create a sendpulse_form post containing a benign SendPulse loader script tag alongside arbitrary HTML (e.g., an img onerror payload), which bypasses the allow-list check and executes in the browser of any user — including administrators — who previews or views a page rendering the [sendpulse-form] shortcode.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/01/2026
The vulnerability identified in the SendPulse Email Marketing Newsletter plugin for WordPress represents a critical stored cross-site scripting flaw that undermines the security integrity of WordPress installations. This weakness exists within all versions up to and including 2.2.5, where the plugin fails to properly sanitize user input data during the processing of post meta fields. The specific vulnerability manifests through the _sp_form_code Post Meta parameter which does not adequately validate or escape potentially malicious content, creating an avenue for attackers to execute persistent code injections within the target environment.
The technical implementation of this vulnerability stems from insufficient input sanitization mechanisms that should have prevented the storage of malicious scripts within the WordPress database. The plugin's allow-list validation process proves inadequate as it permits the injection of arbitrary HTML elements alongside legitimate SendPulse loader script tags, effectively bypassing security controls designed to restrict content modification. This flaw operates at the application layer and specifically targets the post meta data handling functionality where user-contributed content gets stored without proper sanitization procedures.
Attackers with contributor-level access or higher can exploit this vulnerability by creating malicious sendpulse_form posts containing benign-looking SendPulse loader script tags combined with malicious HTML payloads such as img onerror attributes. The execution occurs when users preview or view pages that render the [sendpulse-form] shortcode, making this attack vector particularly dangerous as it can affect any user who accesses affected content including high-privilege administrators. This stored XSS vulnerability enables persistent code execution that remains active until manually removed from the database, potentially allowing for session hijacking, privilege escalation, or data exfiltration operations.
The operational impact of this vulnerability extends beyond simple script execution as it provides attackers with a foothold for more sophisticated attacks within the WordPress environment. Any user who previews or views pages containing the malicious shortcode becomes an unwitting participant in the attack chain, potentially leading to complete system compromise if administrators are among the affected users. The vulnerability aligns with CWE-79 (Cross-site Scripting) and maps to attack techniques in the MITRE ATT&CK framework under T1059.001 (Command and Scripting Interpreter: PowerShell) and T1566 (Phishing), as it enables attackers to establish persistent access through malicious content injection.
Mitigation strategies should focus on immediate plugin updates to versions that address the sanitization issues, though administrators should also implement additional security measures such as role-based access controls, regular monitoring of post meta data changes, and content filtering solutions. Database-level protections including input validation at multiple layers and output escaping for all dynamic content can help reduce the risk of exploitation. Security professionals should also consider implementing web application firewalls to detect and block suspicious payload patterns, while maintaining comprehensive audit logs to track unauthorized modifications to critical post meta fields that could indicate exploitation attempts.