Stored XSS in WordPress Live Webcam Widget & Shortcode

CVE-2025-10129

What is CVE-2025-10129?

The Live Webcam Widget & Shortcode plugin for WordPress is susceptible to a stored cross-site scripting vulnerability due to inadequate input sanitization and output escaping on user-supplied attributes in the 'webcam' shortcode. Authenticated users with contributor-level permissions or higher can exploit this flaw by injecting arbitrary scripts into web pages. These scripts execute whenever a victim accesses a modified page, presenting serious security risks to website users. Immediate action is advised to mitigate this vulnerability.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References