Stored XSS in WordPress Live Webcam Widget & Shortcode

CVE-2025-10129

What is CVE-2025-10129?

The Live Webcam Widget & Shortcode plugin for WordPress is susceptible to a stored cross-site scripting vulnerability due to inadequate input sanitization and output escaping on user-supplied attributes in the 'webcam' shortcode. Authenticated users with contributor-level permissions or higher can exploit this flaw by injecting arbitrary scripts into web pages. These scripts execute whenever a victim accesses a modified page, presenting serious security risks to website users. Immediate action is advised to mitigate this vulnerability.

References