The WP‑Clippy plugin suffers from insufficient sanitization of shortcode attributes, allowing a stored cross‑site scripting (XSS) flaw. An authenticated user with contributor or higher privileges can inject arbitrary JavaScript into any page that uses the clippy shortcode. When another visitor loads that page, the malicious script runs in their browser, potentially compromising session cookies, stealing credentials, or defacing content.

WordPress sites running the WP‑Clippy plugin, versions 1.0.0 and earlier.

The CVSS score of 6.4 indicates moderate severity, while the EPSS score is not available and the vulnerability is not listed in CISA KEV. Because an attacker must be authenticated at a contributor level, the public exposure is limited, but once the malicious content is stored it affects all users who view the impacted page. The risk remains significant for sites that allow contributor‑level users to submit or edit shortcode content.