CVE-2025-13515: Nouri.sh Newsletter Plugin XSS Flaw

CVE-2025-13515 Overview

CVE-2025-13515 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Nouri.sh Newsletter plugin for WordPress. The flaw affects all versions up to and including 1.0.1.3. It stems from insufficient input sanitization and output escaping of the $_SERVER['PHP_SELF'] variable in the plugin's options.phtml template. Unauthenticated attackers can inject arbitrary web scripts that execute when a user is tricked into clicking a crafted link. The issue is classified under CWE-79.

Critical Impact
Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser session, enabling session theft, credential harvesting, or administrative action hijacking on WordPress sites running the vulnerable plugin.

Affected Products

Nouri.sh Newsletter plugin for WordPress, versions up to and including 1.0.1.3
WordPress sites using the plugin's options.phtml template
Administrative pages that echo the $_SERVER['PHP_SELF'] value without escaping

Discovery Timeline

2025-12-05 - CVE-2025-13515 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13515

Vulnerability Analysis

The vulnerability exists in the templates/options.phtml file of the Nouri.sh Newsletter plugin. The template renders the value of $_SERVER['PHP_SELF'] directly into HTML output without sanitization or escaping. PHP populates $_SERVER['PHP_SELF'] from the request URI, so attackers can inject characters via the URL path following the script name.

Because the value reaches the DOM unescaped, attacker-controlled payloads execute as script content in the victim's browser. The attack is reflected, requiring user interaction such as clicking a crafted link. Exploitation does not require authentication.

The scope-changed CVSS metric indicates the injected script can impact resources beyond the vulnerable component, including any WordPress administrative context the victim holds. According to EPSS data (0.212%, 11.564 percentile), broad automated exploitation is currently unlikely, though targeted phishing scenarios remain practical.

Root Cause

The root cause is unsafe use of $_SERVER['PHP_SELF'] in the plugin's admin template. WordPress developers should escape any server-side value rendered into HTML using functions such as esc_url() or esc_attr(). The plugin instead emits the raw string, allowing HTML and JavaScript characters supplied by the URL to break out of the intended context.

Attack Vector

An attacker crafts a URL targeting the plugin's admin page and appends a malicious payload after the script name, for example /wp-admin/admin.php/"><script>...</script>?page=nourish-options. The attacker delivers the link through phishing, social media, or comment injection. When an authenticated WordPress user visits the URL, the payload executes in their session and can perform actions with their privileges.

Refer to the Wordfence Vulnerability Report and the WordPress Plugin Template File for the vulnerable code location.

Detection Methods for CVE-2025-13515

Indicators of Compromise

Web server access logs containing requests to plugin admin paths with encoded angle brackets, <script>, javascript:, or onerror= tokens in the URI path
Requests to /wp-admin/admin.php/* variants where the path segment includes HTML metacharacters before the query string
Referrer headers pointing to external phishing domains preceding administrative sessions
Unexpected outbound requests from browser sessions of WordPress administrators shortly after visiting plugin pages

Detection Strategies

Deploy web application firewall (WAF) rules that flag HTML and script metacharacters in the URI path component of wp-admin requests
Enable file integrity monitoring on the wp-content/plugins/newsletters-from-rss-to-email-newsletters-using-nourish/ directory to detect tampering
Alert on WordPress admin sessions issuing API calls that do not match normal administrator workflows

Monitoring Recommendations

Aggregate WordPress access logs into a centralized log platform and hunt for suspicious PHP_SELF payloads
Monitor for creation of new WordPress administrator accounts or changes to user roles following suspicious admin page visits
Track browser-side Content Security Policy (CSP) violation reports for inline script execution on wp-admin pages

How to Mitigate CVE-2025-13515

Immediate Actions Required

Deactivate the Nouri.sh Newsletter plugin on any WordPress site running version 1.0.1.3 or earlier until a patched release is confirmed
Restrict access to wp-admin pages by IP allowlist or VPN where feasible to reduce phishing exposure
Instruct WordPress administrators to avoid clicking untrusted links, especially those targeting admin URLs

Patch Information

At the time of publication, no fixed version is referenced in the NVD entry. Site owners should monitor the WordPress plugin repository for an update that escapes $_SERVER['PHP_SELF'] with esc_url() or replaces its use with a hardcoded admin URL. Consult the Wordfence Vulnerability Report for the latest remediation guidance.

Workarounds

Configure a WAF rule to block wp-admin requests containing <, >, or %3C/%3E in the URI path segment
Deploy a strict Content Security Policy that disallows inline scripts on WordPress admin pages
Enforce two-factor authentication for all administrative accounts to reduce impact of session hijacking through XSS
Temporarily replace the plugin with an alternative newsletter solution until a fix is released

bash

# Example ModSecurity rule blocking HTML metacharacters in wp-admin URI paths
SecRule REQUEST_URI "@rx ^/wp-admin/.*(<|%3C|>|%3E|script|onerror=)" \
  "id:1013515,phase:1,deny,status:403,log,\
   msg:'Potential CVE-2025-13515 reflected XSS attempt via PHP_SELF'"