eID Easy, a WordPress plugin, suffers a stored cross‑site scripting flaw triggered by the id query parameter. Because the plug‑in fails to sanitize user input or escape output, authenticated users with Contributor or higher privileges can insert arbitrary JavaScript into persisted content. When a visitor loads the affected page, the malicious script executes in the visitor’s browser, enabling the attacker to steal credentials, hijack sessions, deface the site, or deliver further payloads. The vulnerability is a classic input validation weakness (CWE‑79) that allows attackers to execute arbitrary client‑side code.

The flaw is present in all eID Easy releases up to and including version 4.9.3 on any WordPress installation. Sites running the plugin in that version range are vulnerable; older versions are also susceptible as they share the same code path. No release after 4.9.3 is listed as affected, but the plugin may still lack a remedy until the vendor releases a patch. WordPress itself is not inherently vulnerable; the problem lies solely in the plug‑in.

The CVSS score of 6.4 indicates moderate severity. The EPSS score of fewer than 1 % suggests that, at the time of this analysis, the exploitation probability observed in the wild is low. The vulnerability is not catalogued in the CISA KEV list. Exploitation requires an authenticated Contributor or higher account, so attackers must first obtain valid credentials or inject the payload through a compromised user session. Once authenticated, the attacker can persist malicious code that will run for every site visitor that accesses the infected page, making the risk significant for sites with high traffic or sensitive data.