The Easy Portfolio plugin for WordPress, developed by Tushar Patel, contains a stored cross-site scripting vulnerability due to improper input sanitization during web page generation. This flaw allows an attacker with low privileges to inject malicious scripts that are stored and executed in the context of other users, potentially leading to information disclosure, integrity loss, and availability impact. The vulnerability affects all versions up to 1.3. No official patch or vendor advisory has been provided yet.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of affected users, potentially leading to partial confidentiality, integrity, and availability impacts as indicated by the CVSS vector. This could result in session hijacking, defacement, or other malicious actions within the scope of the affected application. However, exploitation requires user interaction and some level of privilege.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the plugin functionality to trusted users only and monitor for suspicious activity. Avoid inputting untrusted data into the plugin and apply standard web application security best practices relevant to XSS mitigation.