This vulnerability (CVE-2025-30763) involves improper input neutralization leading to stored cross-site scripting in the EO4WP plugin by Olaf Lederer, affecting versions up to 1.0.8.4. An attacker with low privileges and requiring user interaction can inject malicious scripts that are stored and later executed in the context of the web application, potentially impacting confidentiality, integrity, and availability. The CVSS 3.1 base score is 6.5 (medium), with attack vector network, low attack complexity, privileges required low, user interaction required, and scope changed. No patch or vendor advisory is currently provided, and no exploits are known in the wild.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to information disclosure, modification of data, or disruption of service. The impact affects confidentiality, integrity, and availability but requires user interaction and low privileges, limiting the ease of exploitation. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently documented, users should monitor for updates from Olaf Lederer or the EO4WP project. Until a fix is available, consider restricting user input or applying web application firewall rules to detect and block XSS payloads related to this vulnerability.