The vulnerability in the WP‑Clap plugin allows reflected XSS because input is not properly neutralized when generating a web page. An attacker could embed malicious JavaScript that executes in the context of users who view a crafted page or URL, potentially compromising user credentials, defacing content, or redirecting to phishing sites. The weakness is a classic input validation flaw (CWE‑79).

This flaw affects the WP‑Clap plugin supplied by Ariagle, version 1.5 and earlier. Any WordPress site running those plugin versions is vulnerable, regardless of the number of site visitors or role of users that may trigger the reflected payload.

The CVSS score of 7.1 indicates moderate‑to‑high impact. The EPSS score is reported as < 1 %, suggesting that exploitation is not widespread yet, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a crafted URL or form field that an attacker can send to a victim or embed in a social‑engineering message; the exploit requires only that the victim view the vulnerable page, posing a non‑authenticated risk. Given these metrics, the risk is meaningful but not urgently critical, yet a patch should be applied promptly to eliminate the XSS vector.