The web‑cam plugin for WordPress is susceptible to stored Cross‑Site Scripting caused by inadequate input sanitization and output escaping on the 'slug’ field. Authenticated users with Contributor level or higher can submit any JavaScript payload that will be persisted in the database and executed each time a user loads the affected page. This allows arbitrary script execution by users who view the injected page.

The vulnerability affects the WordPress plugin "web‑cam" developed by murtuzamakda52. All released versions up to and including 3.0 are impacted; no mitigations or patches are provided for these specific releases.

The CVSS score of 6.4 indicates moderate severity, while the EPSS score of <1% suggests a low likelihood of exploitation. The issue is not listed in the CISA KEV catalog. Because the exploitation requires authenticated Contributor‑level access, an attacker must be able to log into the site with sufficient privileges to insert the payload. Once injected, the scripts run for any user who loads the stored page.