The Layers WordPress plugin is vulnerable to stored cross‑site scripting through its 'webcam' shortcode. The flaw arises because user‑supplied attributes are not properly sanitized or escaped. As a result, scripts supplied in the shortcode can be injected into posts or pages and will be executed whenever an authenticated user with contributor access or higher views the page. This flaw permits attackers to execute arbitrary client‑side code, potentially leading to session hijacking, defacement, or phishing attempts. The weakness is classified as CWE‑79.

Affected vendor is StripesWP, product Layers. All released versions up to and including 0.5 of the plugin are impacted. The plugin is used within WordPress installations that support the 'webcam' shortcode.

The CVSS score of 6.4 indicates a medium level of severity. The EPSS score is less than 1%, suggesting a low likelihood of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the attacker is authenticated with contributor access or higher. An attacker can then insert malicious scripts through the 'webcam' shortcode, which will be rendered in the output when a page containing that shortcode is loaded by any site visitor.