CVE-2025-47547 Overview
CVE-2025-47547 is a stored cross-site scripting (XSS) vulnerability in the SendPulse Email Marketing Newsletter plugin for WordPress. The flaw affects all versions up to and including 2.1.6. An authenticated attacker with low privileges can inject persistent JavaScript payloads that execute in the browser of any user who views the affected page. The vulnerability is tracked under CWE-79 for improper neutralization of input during web page generation.
Critical Impact
Attackers can persist malicious scripts into WordPress pages served by the plugin, enabling session theft, administrative action abuse, and downstream compromise of site visitors.
Affected Products
- SendPulse Email Marketing Newsletter plugin for WordPress, versions up to and including 2.1.6
- WordPress sites with the sendpulse-email-marketing-newsletter plugin installed and activated
- Any authenticated WordPress role permitted to submit input processed by the plugin
Discovery Timeline
- 2025-05-07 - CVE-2025-47547 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-47547
Vulnerability Analysis
The plugin fails to properly neutralize user-supplied input before rendering it inside HTML output. When an authenticated user submits data through an affected plugin field, the payload is stored in the WordPress database. On subsequent page loads, the stored content is emitted into the DOM without contextual encoding or sanitization. This allows arbitrary JavaScript to execute in the context of the vulnerable site.
The attack requires low privileges and user interaction, and the scope changes because the injected script executes in a victim's browser session against the WordPress origin. Successful exploitation can expose session cookies, forge authenticated requests, or pivot into administrative functionality when a privileged user visits the affected page.
Root Cause
The root cause is missing output encoding and input sanitization within the plugin's rendering paths. WordPress provides helpers such as esc_html(), esc_attr(), and wp_kses_post() for safe output, along with sanitize_text_field() for input filtering. The plugin does not consistently apply these controls to user-controllable fields before persisting them or emitting them into HTML.
Attack Vector
An attacker with an authenticated low-privilege WordPress account submits a crafted payload containing HTML or JavaScript through an input handled by the plugin. The payload is stored server-side. When any authenticated user, including administrators, subsequently views the page containing the stored data, the script executes in their browser. Because the vulnerability has a changed scope, the compromise can extend beyond the plugin boundary to the wider WordPress instance.
No public proof-of-concept exploit code is available. See the Patchstack Vulnerability Report for the disclosure record.
Detection Methods for CVE-2025-47547
Indicators of Compromise
- Stored plugin content containing <script> tags, inline event handlers such as onerror= or onload=, or javascript: URIs.
- Unexpected outbound requests from administrator browsers to attacker-controlled domains after visiting plugin-managed pages.
- New or modified WordPress administrator accounts, plugin installations, or theme file changes following administrator page visits.
- Anomalous authenticated admin-ajax.php or REST API activity originating from administrator sessions.
Detection Strategies
- Audit database tables used by sendpulse-email-marketing-newsletter for HTML or script payloads stored in text fields.
- Deploy a web application firewall rule set that inspects POST bodies for XSS payload patterns targeting the plugin's endpoints.
- Enable Content Security Policy (CSP) reporting to surface script executions that violate an allowlist policy.
- Correlate WordPress user activity logs with the introduction of new stored content in plugin fields.
Monitoring Recommendations
- Monitor WordPress wp-admin sessions for unexpected script execution using browser telemetry or CSP violation reports.
- Alert on privilege changes, plugin uploads, and file writes to wp-content/ initiated from administrator sessions.
- Track plugin version inventory across managed WordPress hosts and flag installations of sendpulse-email-marketing-newsletter at version 2.1.6 or earlier.
How to Mitigate CVE-2025-47547
Immediate Actions Required
- Identify all WordPress sites running the SendPulse Email Marketing Newsletter plugin and record installed versions.
- Update the plugin to a patched release once available from the vendor; if no fix is available, deactivate and remove the plugin.
- Review plugin-managed content and remove any stored HTML or JavaScript payloads found in database fields.
- Rotate credentials and invalidate active sessions for administrator accounts that may have viewed injected content.
Patch Information
The advisory covers versions up to and including 2.1.6. Consult the Patchstack Vulnerability Report for the current patch status and upgrade guidance from the plugin maintainer.
Workarounds
- Deactivate the sendpulse-email-marketing-newsletter plugin until a fixed release is confirmed.
- Restrict WordPress account creation and reduce the number of accounts holding roles that can submit input to the plugin.
- Deploy a WordPress-aware web application firewall with rules that block stored XSS payloads targeting plugin endpoints.
- Enforce a strict Content Security Policy that blocks inline scripts and disallows untrusted script sources.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.