The eID Easy WordPress plugin suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Specifically, the 'id' parameter is not properly sanitized or escaped, enabling authenticated users with Contributor-level or higher privileges to inject arbitrary JavaScript code. This code executes in the context of users who visit the compromised pages, potentially leading to session hijacking or other client-side attacks. The vulnerability affects all versions up to 4.9.3. The CVSS 3.1 base score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and partial confidentiality and integrity impact with no availability impact. No patch or official fix has been documented in the provided data.

An attacker with Contributor-level or higher privileges can inject persistent malicious scripts into pages via the vulnerable 'id' parameter. These scripts execute in the browsers of users who access the affected pages, potentially compromising user sessions or performing unauthorized actions within the context of the victim's privileges. The impact includes partial confidentiality and integrity loss but no availability impact. Since the vulnerability requires authenticated access, exploitation is limited to users with some level of trust on the site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider implementing additional input validation or output escaping at the application or web server level to mitigate injection risks. Monitor for updates from the vendor regarding patches or official mitigations.