EUVD-2026-51688
GHSA-5jrx-957p-3f93
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
PR:L confirmed by contributor-level requirement; UI:R applied because victim must browse to the injected page, per CVSS 3.1 user-interaction definition; S:C retained for cross-browser-context impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The SendPulse Email Marketing Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via _sp_form_code Post Meta in all versions up to, and including, 2.2.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the attacker to create a sendpulse_form post containing a benign SendPulse loader script tag alongside arbitrary HTML (e.g., an img onerror payload), which bypasses the allow-list check and executes in the browser of any user - including administrators - who previews or views a page rendering the [sendpulse-form] shortcode.
AnalysisAI
Stored Cross-Site Scripting in the SendPulse Email Marketing Newsletter WordPress plugin (all versions through 2.2.5) allows authenticated contributors to inject persistent malicious scripts that execute against any visitor - including administrators - who views a page rendering the [sendpulse-form] shortcode. The attack exploits an allow-list bypass in the _sp_form_code Post Meta: by prepending a benign SendPulse loader script tag to an arbitrary payload (such as an img onerror handler), the sanitization check is circumvented and the script is stored and later reflected into victim browsers. No public exploit or CISA KEV listing has been identified at time of analysis, but the detailed bypass technique described in the disclosure lowers the bar for reproduction significantly.
Technical ContextAI
The vulnerability resides in two files of the SendPulse Email Marketing Newsletter WordPress plugin (CPE: cpe:2.3:a:sendpulse:sendpulse_email_marketing_newsletter:*:*:*:*:*:*:*:*): class-senpulse-newsletter-shortcodes.php (line 101) and class-senpulse-newsletter-forms.php (line 103). The plugin implements a shortcode [sendpulse-form] that reads the _sp_form_code Post Meta value associated with a sendpulse_form custom post type and renders it into page HTML. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): the plugin applies an allow-list check intended to restrict what markup is accepted, but this check is bypassable by including a legitimate SendPulse loader script tag first - the validator treats the block as trusted - allowing arbitrary trailing HTML (e.g., an img element with an onerror event handler) to pass through unescaped and be stored persistently in the WordPress database.
RemediationAI
No vendor-released patch has been identified at time of analysis - the referenced source files point to version 2.2.5, which is the last confirmed vulnerable release. Site administrators should check the WordPress plugin repository and the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/4bae687b-5b54-4151-871e-7a9b6e56986e) for an updated release and apply it immediately when available. As a compensating control while awaiting a patch, restrict contributor-level and above access to the minimum required set of trusted users - this eliminates the PR:L attack surface. Additionally, disabling or removing the SendPulse Email Marketing Newsletter plugin entirely is the most effective interim mitigation; this prevents the [sendpulse-form] shortcode from rendering stored payloads but will remove email marketing form functionality. Wordfence firewall rules, if deployed, may provide virtual patching coverage. Audit existing sendpulse_form post meta values for unexpected script tags or onerror-style event handlers to check for prior exploitation.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today