Read the docs

SendPulse

Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

SendPulse records in CISA KEV

No SendPulse vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Free Web Push 1 record MEDIUM Sendpulse Email Marketing Newsletter 1 record LOW

Records

6 records

TI-2024-08523 CVE-2024-9184 · GHSA-3x34-6x7v-gx9x

SendPulse Free Web Push <= 1.3.6 - Unauthenticated Stored Cross-Site Scripting

Priority LOW 34

The SendPulse Free Web Push plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.3.6 due to incorrect use of the wp_kses_allowed_html function.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00454 Published 2024-10-17 No fix listed CWE-79
TI-2026-11323 CVE-2026-13362 · GHSA-5jrx-957p-3f93

Cross-site scripting in SendPulse Email Marketing Newsletter

Priority LOW 28

The SendPulse Email Marketing Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via _sp_form_code Post Meta in all versions up to, and including, 2.2.5 due to insufficient input sanitization an…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00348 Published 2026-08-01 No fix listed CWE-79
TI-2025-30044 CVE-2025-47547 · GHSA-p45p-8j5c-872r

WordPress SendPulse Email Marketing Newsletter plugin <= 2.1.6 - Cross Site Scripting (XSS) Vulnerability

Priority LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SendPulse SendPulse Email Marketing Newsletter sendpulse-email-marketing-newsletter allows Stored XSS.This issue affec…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00268 Published 2025-05-07 No fix listed CWE-79
TI-2025-16545 CVE-2025-22662 · GHSA-wrwg-x4qh-4cp5

WordPress SendPulse Email Marketing Newsletter plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerability

Priority LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SendPulse SendPulse Email Marketing Newsletter sendpulse-email-marketing-newsletter allows Stored XSS.This issue affec…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00232 Published 2025-02-04 No fix listed CWE-79
TI-2025-41557 CVE-2025-67948 · GHSA-526w-gq45-2f4f

WordPress SendPulse Email Marketing Newsletter plugin <= 2.2.1 - Sensitive Data Exposure vulnerability

Priority LOW 20

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in SendPulse SendPulse Email Marketing Newsletter sendpulse-email-marketing-newsletter allows Retrieve Embedded Sensitive Data.This…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00255 Published 2025-12-16 No fix listed CWE-497
Open these records in search →