The murtuzamakda52 web-cam WordPress plugin suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input in the 'slug' parameter. Authenticated users with Contributor or higher privileges can inject arbitrary JavaScript code that executes in the context of other users visiting the affected pages. This vulnerability affects all plugin versions up to 3.0. The CVSS 3.1 base score is 6.4 (medium), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and limited confidentiality and integrity impacts. No patch or official remediation guidance is currently available.

Successful exploitation allows an authenticated user with Contributor-level access or higher to inject and store malicious scripts in pages generated by the plugin. These scripts execute in the browsers of users who view the infected pages, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability does not impact availability and has limited confidentiality and integrity impact as per CVSS metrics. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level and higher access to trusted users only. Consider disabling or removing the vulnerable plugin if possible to prevent exploitation. Monitor official channels for updates or patches from the vendor.