Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Vendor: SendPulse Clear all filters
TI-2026-11323 CVE-2026-13362 · GHSA-5jrx-957p-3f93

Cross-site scripting in SendPulse Email Marketing Newsletter

Priority LOW 28

The SendPulse Email Marketing Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via _sp_form_code Post Meta in all versions up to, and including, 2.2.5 due to insufficient input sanitization an…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00348 Published 2026-08-01 No fix listed CWE-79
TI-2025-41557 CVE-2025-67948 · GHSA-526w-gq45-2f4f

WordPress SendPulse Email Marketing Newsletter plugin <= 2.2.1 - Sensitive Data Exposure vulnerability

Priority LOW 20

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in SendPulse SendPulse Email Marketing Newsletter sendpulse-email-marketing-newsletter allows Retrieve Embedded Sensitive Data.This…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00255 Published 2025-12-16 No fix listed CWE-497
TI-2025-30044 CVE-2025-47547 · GHSA-p45p-8j5c-872r

WordPress SendPulse Email Marketing Newsletter plugin <= 2.1.6 - Cross Site Scripting (XSS) Vulnerability

Priority LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SendPulse SendPulse Email Marketing Newsletter sendpulse-email-marketing-newsletter allows Stored XSS.This issue affec…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00268 Published 2025-05-07 No fix listed CWE-79
TI-2025-16545 CVE-2025-22662 · GHSA-wrwg-x4qh-4cp5

WordPress SendPulse Email Marketing Newsletter plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerability

Priority LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SendPulse SendPulse Email Marketing Newsletter sendpulse-email-marketing-newsletter allows Stored XSS.This issue affec…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00232 Published 2025-02-04 No fix listed CWE-79
TI-2024-08523 CVE-2024-9184 · GHSA-3x34-6x7v-gx9x

SendPulse Free Web Push <= 1.3.6 - Unauthenticated Stored Cross-Site Scripting

Priority LOW 34

The SendPulse Free Web Push plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.3.6 due to incorrect use of the wp_kses_allowed_html function.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00454 Published 2024-10-17 No fix listed CWE-79