CVE-2026-13362

Name of the Vulnerable Software and Affected Versions SendPulse Email Marketing Newsletter versions prior to 2.2.6

Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to perform Stored Cross-Site Scripting (XSS). An attacker can inject arbitrary web scripts into pages by creating a sendpulse form post that includes a benign SendPulse loader script tag combined with arbitrary HTML, such as an img onerror payload. This technique bypasses the allow-list check, causing the scripts to execute in the browser of any user, including administrators, who previews or views a page rendering the [sendpulse-form] shortcode. The issue specifically involves the sp form code Post Meta.

Recommendations Update to a version newer than 2.2.5.