CVE-2025-10130 is a stored cross-site scripting vulnerability in the stripeswp Layers WordPress plugin affecting all versions up to 0.5. It results from improper neutralization of input during web page generation (CWE-79), specifically in the 'webcam' shortcode, where user-supplied attributes are not properly sanitized or escaped. Authenticated attackers with contributor-level privileges or higher can exploit this to inject malicious scripts that execute in the context of users visiting the compromised pages. The vulnerability has a CVSS 3.1 score of 6.4, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the 'webcam' shortcode. These scripts execute in the browsers of users who view the injected pages, potentially leading to information disclosure or session hijacking. The vulnerability does not affect availability and requires authenticated access, limiting its impact to environments where such access is granted.

No official patch or remediation is currently documented for this vulnerability. Users should monitor the vendor's advisory channels for updates. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Layers plugin if feasible to prevent exploitation.