Live Webcam Widget CVE-2025-10129

Exploitation requires an authenticated WordPress account with contributor-level privileges or higher (PR:L) on a site running the Live Webcam Widget & Shortcode plugin version 1.2 or earlier, and the ability to use the plugin's 'webcam' shortcode with attacker-controlled attribute values within post or page content. The payload only fires when a user subsequently views the page containing the injected shortcode, so a victim must visit the affected content for impact to occur. The primary limiting factor is the authentication requirement: the attack is not available to fully unauthenticated remote attackers, confining it to sites that grant contributor access or where such an account has been compromised; the plugin must also be installed and the shortcode feature in use.

This is a genuine but low-priority issue, not a high-urgency threat. The CVSS 3.1 base score of 6.4 (Medium) reflects a network-reachable (AV:N) stored XSS requiring only low privileges (PR:L) and no victim interaction to inject, with a scope change (S:C) because scripts execute in the browsers of other users. All exploitation signals point to low real-world risk: EPSS is only 0.19% (8th percentile), the CVE is NOT listed in CISA KEV, and no public exploit code is referenced in the provided intelligence. The key limiting factor is the authentication barrier - an attacker needs an existing contributor-level (or higher) account on the target WordPress site, which confines this to insider abuse, compromised low-tier accounts, or sites with open/weak registration. The CVSS and description are consistent (both indicate authenticated, network-based stored XSS), so there is no conflicting data here; the main caveat is that no SSVC decision, KEV entry, or POC was provided, so the exploitation-status assessment rests on absence of evidence rather than vendor confirmation of non-exploitation.

An attacker who holds or compromises a contributor-level WordPress account inserts the plugin's 'webcam' shortcode into a draft or page with a malicious attribute value containing JavaScript. Because the attribute is neither sanitized on input nor escaped on output, the payload is stored and then executes in the browser of any user - including administrators - who later views the page, enabling session or cookie theft and admin-action forgery. No public proof-of-concept exploit was identified in the provided data.