The vulnerability in the SendPulse Email Marketing Newsletter plugin allows authenticated users with contributor-level privileges or higher to inject arbitrary HTML and JavaScript into the _sp_form_code post meta field. The injected content is stored and later rendered when the [sendpulse-form] shortcode is displayed, resulting in a stored cross‑site scripting (XSS) flaw. Because the plugin does not properly sanitize or escape this input, an attacker can execute malicious scripts in the browsers of any visitor who loads the affected page, potentially compromising account credentials, defacing content, or performing further attacks. This flaw is classified as CWE‑79.

All versions of the SendPulse Email Marketing Newsletter plugin up to and including 2.2.5 are vulnerable. The issue applies to installations that allow contributor‑level or higher users to create or edit sendpulse_form posts. The affected product is the SendPulse plugin for WordPress, specifically the SendPulse Email Marketing Newsletter module. No other products or versions were listed as affected.

The CVSS score is 6.4, indicating a medium severity vulnerability. The EPSS score is less than 1 %, suggesting a low probability of exploitation in the immediate term, and the issue is not listed in the CISA KEV catalog. The attack requires an authenticated user with sufficient privileges to create or edit a sendpulse_form post containing a benign loader script and malicious payload that bypasses the plugin’s allow‑list. Once injected, the malicious code executes automatically in the browser of any user who views a page rendering the [sendpulse-form] shortcode, including administrators. Based on the description, it is inferred that exploitation is possible when the form is displayed to site visitors.