The vulnerability resides in the webclap_button shortcode of the Yet Another WebClap for WordPress plugin. Because the 'text' attribute is neither sanitized during input nor escaped during output, an attacker can store malicious JavaScript that will run when any user views a page containing the shortcode. The weakness is a classic Stored Cross‑Site Scripting (CWE‑79).

The issue affects the Yet Another WebClap for WordPress plugin from the vendor ksakai. All released versions up to and including 0.2 are impacted.

The CVSS score of 6.4 indicates a moderate severity. The EPSS score is below 1%, implying a very low probability of exploitation in the current environment. The vulnerability is not listed in the CISA KEV catalog. Based on the description, authenticating as a user with at least Contributor level is required, so the attack vector is likely a controlled input from an authorized account, rather than an arbitrary remote exploitation.