The WordPress Live Webcam Widget & Shortcode plugin is vulnerable because attributes given to the webcam shortcode are not properly sanitized or escaped. This flaw allows an authenticated user with contributor or higher privileges to inject malicious scripts into a page that any visitor sees. The injected payload executes in the victim’s browser when the page is viewed.

The vulnerability affects the WordPress Live Webcam Widget & Shortcode plugin from miksco, in all releases up to and including version 1.2. Sites that have not updated beyond 1.2 are vulnerable.

The flaw has a CVSS score of 6.4, indicating moderate severity. The EPSS score is less than 1%, suggesting a low probability of active exploitation, and the vulnerability is not listed in the CISA KEV catalog. Because the attack requires authenticated contributor access, an attacker must log in to the WordPress site; once authenticated they can add content that includes the webcam shortcode with malicious attributes. The malicious script is stored and will run for any user who views the affected page, providing a persistent attack surface.