The CVSS 6.4 rating for this vulnerability misses the real threat. This isn't a simple stored XSS — it's a privilege escalation mechanism that exploits WordPress's trust architecture between contributor roles and administrative users.
The core issue: the SendPulse plugin maintainers added their loader script to an allow-list to work around WordPress's content filtering stripping the legitimate script. Attackers nest malicious payloads alongside this trusted loader, and the sanitization logic fails to recognize the img tag as hostile precisely because it arrives wrapped in trusted context. This 'benign carrier' pattern is more dangerous than raw XSS injection because the plugin's security boundary is defined by component origin rather than content behavior — a fundamentally broken security model.
The privilege escalation dynamic is what makes this severe. Contributors cannot publish content in WordPress by design — their work requires editorial review. This plugin creates a shortcut: inject a sendpulse_form post with an onerror payload, and every administrator who previews or reviews that post becomes a victim. The attacker doesn't compromise an admin account directly; they weaponize the admin's trust in the review process. One contributor account becomes the detonation point for the entire WordPress instance.
Defensive actions:
-
Run this detection query immediately:
SELECT * FROM wp_postmeta WHERE meta_key = '_sp_form_code';Any value containing unescaped HTML or script tags indicates exploitation. This also catches legitimate SendPulse usage, but it's your highest-fidelity hunting signal. -
Identify all contributor-level accounts on your WordPress instances and audit their recent post history, particularly for posts with post_type 'sendpulse_form' or similar custom types.
-
Patch to version 2.2.5 or later. The fix likely addresses write-time sanitization of _sp_form_code post meta — the plugin was escaping at render time but not sanitizing stored payloads at input time.
-
The EPSS score of 0.00203 reflects low current exploitation probability, but this will change within weeks of public disclosure. The 'contributor access required' constraint sounds limiting until you remember that WordPress sites routinely grant contributor roles to external contractors, guest authors, and onboarding employees. Your attack surface is larger than you think.
The blast radius extends temporally: a dormant injected post claims new victims every time a reviewer previews it. A single contaminated post can compromise dozens of admin sessions over weeks or months. That's a 10 for organizational blast radius dressed up as a 6.4 individual exploit event.