CVE-2026-13362: SendPulse WordPress Plugin XSS Vulnerability

CVE-2026-13362 Overview

CVE-2026-13362 is a stored Cross-Site Scripting (XSS) vulnerability in the SendPulse Email Marketing Newsletter plugin for WordPress. The flaw affects all versions up to and including 2.2.5. The root cause is insufficient input sanitization and output escaping of the _sp_form_code post meta value used by the [sendpulse-form] shortcode.

Authenticated users with contributor-level access or above can inject arbitrary JavaScript that executes when any visitor — including administrators — renders the page. The issue is tracked under CWE-79.

Critical Impact
A contributor-level account can store JavaScript that executes in an administrator's browser session, enabling account takeover, privilege escalation, or site-wide compromise.

Affected Products

SendPulse Email Marketing Newsletter plugin for WordPress, all versions through 2.2.5
WordPress sites permitting contributor-or-above registration where the plugin is active
Any page rendering the [sendpulse-form] shortcode from an attacker-controlled sendpulse_form post

Discovery Timeline

2026-08-01 - CVE-2026-13362 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-13362

Vulnerability Analysis

The SendPulse plugin registers a custom sendpulse_form post type and exposes a [sendpulse-form] shortcode. When the shortcode renders, the plugin reads the _sp_form_code post meta and emits its contents into the page HTML. The plugin applies an allow-list intended to permit only the legitimate SendPulse loader <script> tag, but the check can be satisfied by including that benign loader alongside additional attacker-controlled HTML.

Because the surrounding markup is not sanitized against a strict HTML allow-list and is not escaped on output, an attacker can co-locate the loader tag with an injection payload — for example, an <img> element carrying an onerror handler. The payload persists in post meta and executes for every subsequent viewer of the rendered page.

Root Cause

The vulnerability stems from an allow-list validation that inspects the stored value for the presence of a legitimate marker rather than validating the entire structure. The _sp_form_code value is stored as raw HTML and echoed by the shortcode handler without contextual output escaping, violating the WordPress guidance to escape late using functions such as wp_kses_post() or esc_html(). See the plugin form class and shortcode handler for the vulnerable code paths.

Attack Vector

Exploitation requires an authenticated account with contributor privileges or higher. The attacker creates a sendpulse_form post that contains the SendPulse loader <script> tag concatenated with an arbitrary HTML payload. When any page embedding the corresponding [sendpulse-form] shortcode is previewed or viewed, the injected script executes in the viewer's browser context. Because the scope is changed (CVSS S:C), the payload runs against the WordPress admin origin and can perform authenticated actions on behalf of an administrator who visits the page.

No verified public exploit is available. Refer to the Wordfence advisory for additional technical detail.

Detection Methods for CVE-2026-13362

Indicators of Compromise

Presence of sendpulse_form posts created by contributor-level users whose _sp_form_code post meta contains HTML tags beyond the SendPulse loader <script> (for example, <img, onerror=, onload=, <svg, <iframe).
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after previewing or viewing pages containing the [sendpulse-form] shortcode.
New administrator accounts, modified user roles, or plugin/theme file changes correlated with an administrator viewing a sendpulse_form-rendered page.

Detection Strategies

Query the wp_postmeta table for meta_key = '_sp_form_code' and flag values that contain event handler attributes or tags other than the expected SendPulse loader.
Deploy a web application firewall rule to inspect responses containing [sendpulse-form] output and alert on inline event handlers such as onerror, onload, or onclick.
Correlate contributor-level wp_insert_post events for the sendpulse_form post type with subsequent administrator page views.

Monitoring Recommendations

Enable audit logging for post creation, post meta updates, and role changes; retain logs centrally for correlation.
Monitor browser Content Security Policy (CSP) violation reports for script-src or inline-handler blocks originating from WordPress front-end pages.
Alert on any privilege change or plugin installation event occurring within a short window after a sendpulse_form post is created or edited.

How to Mitigate CVE-2026-13362

Immediate Actions Required

Deactivate the SendPulse Email Marketing Newsletter plugin on any site running version 2.2.5 or earlier until a patched release is applied.
Audit all existing sendpulse_form posts and remove entries whose _sp_form_code meta contains HTML beyond the expected SendPulse loader script.
Review the list of contributor, author, and editor accounts; disable or rotate credentials for any account that is unknown or inactive.
Restrict new user self-registration or default registration role to subscriber in WordPress general settings.

Patch Information

At the time of NVD publication, the plugin remained vulnerable in versions up to and including 2.2.5. Monitor the WordPress plugin repository and the Wordfence advisory for a fixed release, and upgrade as soon as a version above 2.2.5 is published by the vendor.

Workarounds

Remove the [sendpulse-form] shortcode from all published content and prevent its use until the plugin is patched.
Enforce a strict Content Security Policy that disallows inline event handlers and restricts script-src to trusted origins.
Limit the capability to publish or edit sendpulse_form posts to trusted administrator accounts using a role editor or a map_meta_cap filter.

bash

# Configuration example: temporarily disable the plugin via WP-CLI
wp plugin deactivate sendpulse-email-marketing-newsletter

# Identify potentially malicious stored payloads
wp db query "SELECT post_id, LEFT(meta_value, 200) FROM wp_postmeta \
  WHERE meta_key = '_sp_form_code' \
  AND (meta_value LIKE '%onerror=%' \
       OR meta_value LIKE '%onload=%' \
       OR meta_value LIKE '%<img%' \
       OR meta_value LIKE '%<svg%' \
       OR meta_value LIKE '%<iframe%');"