CVE-2025-13857: Yet Another WebClap XSS Vulnerability

CVE-2025-13857 Overview

CVE-2025-13857 is a Stored Cross-Site Scripting (XSS) vulnerability in the Yet Another WebClap for WordPress plugin. The flaw affects all versions up to and including 0.2. It stems from insufficient input sanitization and output escaping in the text parameter of the webclap_button shortcode. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages. Those scripts execute in the browser of any visitor who loads the affected page. The vulnerability is tracked under CWE-79.

Critical Impact
Contributor-level users can inject persistent JavaScript that executes against site visitors and administrators, enabling session theft, forced redirects, and privilege escalation via administrator interaction.

Affected Products

Yet Another WebClap for WordPress plugin — all versions through 0.2
WordPress sites permitting Contributor-level (or higher) accounts to publish shortcode-bearing content
Any site using the webclap_button shortcode with the vulnerable text parameter

Discovery Timeline

2025-12-06 - CVE-2025-13857 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13857

Vulnerability Analysis

The vulnerability resides in the webclap_button shortcode handler within yawebclap.php. When a WordPress author uses the shortcode, the plugin accepts a text attribute and renders it into page output. The plugin does not sanitize this attribute on input, and it does not escape it during output rendering.

Because WordPress permits Contributor-level users to author draft content containing shortcodes, a low-privileged authenticated attacker can embed a malicious text value. When an editor or administrator previews the draft, or after a visitor loads the published page, the injected payload executes in the browser context of the WordPress site. Successful exploitation can lead to session hijacking, account takeover, and unauthorized administrative actions performed via the victim's authenticated session.

Root Cause

The root cause is missing input sanitization and missing output escaping on a user-controllable shortcode attribute. The plugin should apply sanitize_text_field() on input and esc_html() or esc_attr() on output, depending on the rendering context. Neither control is present in the vulnerable versions. See the WordPress Plugin Source at line 28 for the affected code path.

Attack Vector

Exploitation requires an authenticated account with Contributor privileges or higher. The attacker creates a post or page that includes the webclap_button shortcode with a text attribute containing an HTML or JavaScript payload. After the content is published or previewed by a higher-privileged user, the payload executes in that user's browser session. Additional analysis is available in the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2025-13857

Indicators of Compromise

Posts or pages containing the [webclap_button] shortcode with text values containing HTML tags such as <script>, <img onerror=...>, or <svg onload=...>
Unexpected outbound requests from administrator browsers to attacker-controlled domains after loading plugin-rendered pages
New administrator accounts or modified user roles created shortly after an administrator previewed a Contributor's draft

Detection Strategies

Audit the WordPress wp_posts table for shortcode entries referencing webclap_button and inspect the text attribute for markup characters (<, >, ", ')
Monitor web server access logs for anomalous JavaScript-loading responses served from pages using the plugin
Review WordPress activity logs for role changes, plugin installs, or option modifications performed shortly after a Contributor account was active

Monitoring Recommendations

Enable Content Security Policy (CSP) headers with reporting endpoints to detect unauthorized inline script execution on plugin-rendered pages
Alert on creation or modification of WordPress user accounts with administrator or editor capabilities
Track Contributor-level account activity, including draft creation, revision volume, and shortcode usage

How to Mitigate CVE-2025-13857

Immediate Actions Required

Deactivate the Yet Another WebClap for WordPress plugin until a patched release is available
Review all existing posts and pages for the webclap_button shortcode and remove any suspicious text values
Reset credentials for all Contributor-level and higher accounts and enforce multi-factor authentication
Restrict Contributor account provisioning to trusted users only

Patch Information

At the time of publication, no patched release beyond version 0.2 is referenced in the NVD entry. Site operators should monitor the WordPress plugin repository for an updated version that adds sanitization on the text shortcode attribute and escapes it during output.

Workarounds

Remove the plugin entirely if the WebClap functionality is not required
Deploy a Web Application Firewall (WAF) rule that blocks POST requests to wp-admin/post.php containing webclap_button shortcodes with HTML tag characters in the text attribute
Downgrade Contributor-level accounts or restrict shortcode rendering with a role-based shortcode filter until the plugin is patched

bash

# Configuration example: locate posts containing the vulnerable shortcode
wp db query "SELECT ID, post_title, post_status FROM wp_posts \
  WHERE post_content LIKE '%[webclap_button%' \
  AND post_content REGEXP 'text=\"[^\"]*[<>][^\"]*\"';"