CVE-2025-10130: Layers WordPress Plugin XSS Vulnerability

CVE-2025-10130 Overview

CVE-2025-10130 is a Stored Cross-Site Scripting (XSS) vulnerability in the Layers plugin for WordPress. The flaw affects all versions up to and including 0.5. It stems from insufficient input sanitization and output escaping on user-supplied attributes passed to the plugin's webcam shortcode.

Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts. The scripts execute in the browser of any user who visits an affected page. The issue is tracked under CWE-79.

Critical Impact
Contributor-level accounts can persist JavaScript payloads in pages, enabling session theft, redirection, and administrative account takeover against visitors including site administrators.

Affected Products

WordPress Layers plugin, all versions up to and including 0.5
WordPress sites permitting contributor-level or higher registrations with Layers installed
Content authored via the plugin's webcam shortcode

Discovery Timeline

2025-09-30 - CVE-2025-10130 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD

Technical Details for CVE-2025-10130

Vulnerability Analysis

The Layers plugin registers a webcam shortcode that accepts user-supplied attributes. The shortcode handler concatenates those attributes into HTML output without sanitizing input or escaping output. An authenticated user with the contributor role or higher can embed the shortcode in post content and supply attribute values containing HTML or JavaScript.

Because the payload is stored in the WordPress database and rendered whenever the containing page loads, this is a persistent (stored) XSS. Any visitor who views the page executes the injected script under the site's origin. Impact includes session hijacking, forced administrative actions via CSRF-like flows, and drive-by redirection.

The scope change reflected in the CVSS vector indicates that a low-privileged contributor can affect resources belonging to higher-privileged users, including administrators who preview or moderate the injected content.

Root Cause

The root cause is missing input validation and missing output escaping in the shortcode callback. WordPress provides sanitize_text_field(), esc_attr(), and esc_html() for exactly this purpose, but the vulnerable handler passes shortcode attributes directly into rendered markup. Reference the plugin source in the WordPress trunk and the remediation changeset for the specific code paths.

Attack Vector

Exploitation requires an authenticated session at contributor level or above. The attacker creates or edits a post containing the webcam shortcode with malicious attribute values crafted to break out of attribute context and inject a <script> tag or event handler. When an editor, administrator, or logged-in visitor renders the post, the payload executes in their browser. No user interaction beyond navigating to the page is required. Details are documented in the Wordfence advisory.

No verified public exploit code is available. The vulnerability mechanism is described in prose above; see the linked changeset for the exact vulnerable and patched lines.

Detection Methods for CVE-2025-10130

Indicators of Compromise

Post or page content in wp_posts containing [webcam ...] shortcode with attribute values that include <, >, javascript:, on*=, or encoded script fragments
Unexpected outbound requests from visitor browsers to attacker-controlled domains sourced from pages rendering the webcam shortcode
Administrator sessions creating new privileged users or plugin installations shortly after viewing a contributor's draft

Detection Strategies

Query the WordPress database for shortcode instances: SELECT ID, post_author, post_status FROM wp_posts WHERE post_content LIKE '%[webcam%'; and inspect attributes for HTML metacharacters
Enable a Content Security Policy in report-only mode to surface inline script executions originating from stored content
Review web server access logs for anomalous POST requests to wp-admin/post.php from contributor accounts containing shortcode payloads

Monitoring Recommendations

Audit the Layers plugin version across all managed WordPress sites and flag any installation at version 0.5 or earlier
Alert on new or modified posts authored by contributor-role accounts, particularly when content includes shortcodes with quote characters or angle brackets in attributes
Track administrator logins that immediately follow visits to pages authored by low-privileged users

How to Mitigate CVE-2025-10130

Immediate Actions Required

Deactivate the Layers plugin on any site running version 0.5 or earlier until a patched release is confirmed
Audit all posts and pages for the webcam shortcode and remove or sanitize any instances authored by non-trusted accounts
Rotate credentials for administrator accounts that may have viewed injected content and invalidate active sessions
Restrict contributor and author role assignments to vetted users only

Patch Information

Refer to the WordPress Layers plugin changeset 3370063 and the plugin page for the corrected shortcode handler. Upgrade to the version that supersedes 0.5 as published by the maintainer.

Workarounds

Remove or disable the webcam shortcode by unregistering it via a mu-plugin using remove_shortcode('webcam')
Deploy a web application firewall rule that blocks requests containing [webcam combined with HTML metacharacters in post body parameters
Downgrade contributor accounts or require editorial review before publishing any post that contains shortcodes

bash

# Unregister the vulnerable shortcode via a must-use plugin
# Save as wp-content/mu-plugins/disable-layers-webcam.php
<?php
add_action('init', function () {
    if (shortcode_exists('webcam')) {
        remove_shortcode('webcam');
    }
}, 20);