Stored Cross-Site Scripting Vulnerability in Yet Another WebClap for WordPress
CVE-2025-13857
6.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 6 December 2025
What is CVE-2025-13857?
The Yet Another WebClap plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping. Attackers with Contributor-level access or higher can exploit this vulnerability by injecting malicious scripts through the 'text' parameter of the webclap_button shortcode. These scripts can execute whenever a user accesses an affected page, potentially leading to unauthorized actions or data exposure.
Affected Version(s)
Yet Another WebClap for WordPress * <= 0.2