Sendpulse
Monthly
Stored Cross-Site Scripting in the SendPulse Email Marketing Newsletter WordPress plugin (all versions through 2.2.5) allows authenticated contributors to inject persistent malicious scripts that execute against any visitor - including administrators - who views a page rendering the [sendpulse-form] shortcode. The attack exploits an allow-list bypass in the _sp_form_code Post Meta: by prepending a benign SendPulse loader script tag to an arbitrary payload (such as an img onerror handler), the sanitization check is circumvented and the script is stored and later reflected into victim browsers. No public exploit or CISA KEV listing has been identified at time of analysis, but the detailed bypass technique described in the disclosure lowers the bar for reproduction significantly.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SendPulse SendPulse Email Marketing Newsletter allows Stored XSS.1.6. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in SendPulse SendPulse Free Web Push plugin <= 1.3.1 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Stored Cross-Site Scripting in the SendPulse Email Marketing Newsletter WordPress plugin (all versions through 2.2.5) allows authenticated contributors to inject persistent malicious scripts that execute against any visitor - including administrators - who views a page rendering the [sendpulse-form] shortcode. The attack exploits an allow-list bypass in the _sp_form_code Post Meta: by prepending a benign SendPulse loader script tag to an arbitrary payload (such as an img onerror handler), the sanitization check is circumvented and the script is stored and later reflected into victim browsers. No public exploit or CISA KEV listing has been identified at time of analysis, but the detailed bypass technique described in the disclosure lowers the bar for reproduction significantly.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SendPulse SendPulse Email Marketing Newsletter allows Stored XSS.1.6. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in SendPulse SendPulse Free Web Push plugin <= 1.3.1 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.