{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13857", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-01T20:31:53.275Z", "datePublished": "2025-12-06T05:49:34.043Z", "dateUpdated": "2026-04-08T17:22:07.688Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:22:07.688Z"}, "affected": [{"vendor": "ksakai", "product": "Yet Another WebClap for WordPress", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "0.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Yet Another WebClap for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' parameter of the webclap_button shortcode in all versions up to, and including, 0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Yet Another WebClap for WordPress <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ca50e5e7-be46-40f1-9782-a72ca8ab7e9a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/yet-another-webclap-for-wordpress/trunk/yawebclap.php#L28"}, {"url": "https://plugins.trac.wordpress.org/browser/yet-another-webclap-for-wordpress/tags/0.2/yawebclap.php#L28"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Gilang Asra Bilhadi"}], "timeline": [{"time": "2025-12-05T16:45:16.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-08T21:29:58.971702Z", "id": "CVE-2025-13857", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-08T21:30:14.559Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13857", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-08T21:29:58.971702Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-08T21:30:08.244Z"}}], "cna": {"title": "Yet Another WebClap for WordPress <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes", "credits": [{"lang": "en", "type": "finder", "value": "Gilang Asra Bilhadi"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "ksakai", "product": "Yet Another WebClap for WordPress", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "0.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-05T16:45:16.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ca50e5e7-be46-40f1-9782-a72ca8ab7e9a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/yet-another-webclap-for-wordpress/trunk/yawebclap.php#L28"}, {"url": "https://plugins.trac.wordpress.org/browser/yet-another-webclap-for-wordpress/tags/0.2/yawebclap.php#L28"}], "descriptions": [{"lang": "en", "value": "The Yet Another WebClap for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' parameter of the webclap_button shortcode in all versions up to, and including, 0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:22:07.688Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13857", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:22:07.688Z", "dateReserved": "2025-12-01T20:31:53.275Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-06T05:49:34.043Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Yet Another WebClap for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' parameter of the webclap_button shortcode in all versions up to, and including, 0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "id": "CVE-2025-13857", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-12-06T06:15:52.633", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/yet-another-webclap-for-wordpress/tags/0.2/yawebclap.php#L28"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/yet-another-webclap-for-wordpress/trunk/yawebclap.php#L28"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ca50e5e7-be46-40f1-9782-a72ca8ab7e9a?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T17:37:51.548387+00:00", "value": {"mitigation_remediation": ["Upgrade the Yet Another WebClap for WordPress plugin to a version newer than 0.2 that includes proper input sanitization and output escaping for the webclap_button shortcode attributes.", "Regenerate or re\u2011limit Contributor\u2011level accounts and enforce the principle of least privilege for users who can create or edit content that may use this shortcode.", "Sanitize or remove any existing 'text' attributes containing suspicious code from existing posts, pages, or other content that may be rendered by the shortcode."], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "The issue affects the Yet Another WebClap for WordPress plugin from the vendor ksakai. All released versions up to and including 0.2 are impacted.", "description_and_impact": "The vulnerability resides in the webclap_button shortcode of the Yet Another WebClap for WordPress plugin. Because the 'text' attribute is neither sanitized during input nor escaped during output, an attacker can store malicious JavaScript that will run when any user views a page containing the shortcode. The weakness is a classic Stored Cross\u2011Site Scripting (CWE\u201179).", "risk_and_exploitability": "The CVSS score of 6.4 indicates a moderate severity. The EPSS score is below 1%, implying a very low probability of exploitation in the current environment. The vulnerability is not listed in the CISA KEV catalog. Based on the description, authenticating as a user with at least Contributor level is required, so the attack vector is likely a controlled input from an authorized account, rather than an arbitrary remote exploitation."}}}}, "created": "2025-12-08T09:39:36.786065+00:00", "updated": "2026-04-21T17:45:16.484680+00:00", "vendors": ["ksakai", "ksakai$PRODUCT$yet_another_webclap_for_wordpress", "wordpress", "wordpress$PRODUCT$wordpress"]}