CVE-2026-13362 is a stored cross-site scripting vulnerability in the SendPulse Email Marketing Newsletter plugin for WordPress, affecting all versions up to and including 2.2.5. The issue stems from improper neutralization of input during web page generation, specifically via the _sp_form_code post meta. Authenticated attackers with contributor or higher privileges can inject arbitrary web scripts by creating a sendpulse_form post containing a benign loader script and arbitrary HTML payloads that bypass allow-list checks. These scripts execute in the context of any user viewing or previewing pages with the [sendpulse-form] shortcode, including administrators. The CVSS 3.1 base score is 6.4, indicating a medium severity vulnerability with network attack vector, low attack complexity, and no user interaction required.

Successful exploitation allows an authenticated contributor or higher to execute arbitrary scripts in the browsers of users who view affected pages, potentially leading to session hijacking, privilege escalation, or other malicious actions within the context of the WordPress site. The vulnerability compromises confidentiality and integrity but does not affect availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and avoid previewing or viewing pages containing the [sendpulse-form] shortcode created by untrusted contributors. Monitor vendor channels for updates and apply official patches once released.