The vulnerability is an improper neutralization of input during web page generation that allows stored XSS. If an attacker is able to inject malicious script through the plugin, it will be persisted and executed in the browsers of any visitor to the affected site, potentially enabling credential theft, defacement, or execution of arbitrary code when users view the impacted pages.

SendPulse Email Marketing Newsletter plugin for WordPress through version 2.1.5 is impacted. The vulnerability appears in all releases up to and including 2.1.5. "SendPulse" is the vendor and "SendPulse Email Marketing Newsletter" is the product.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is below 1% and the vulnerability is not listed in the KEV catalog, suggesting a low likelihood of widespread exploitation at present. Based on the description, it is inferred that an attacker would need a way to provide malicious input to the plugin, likely through an administrative or user‑facing interface, after which the script would run in the context of any visitor to the affected page.