The vulnerability exists in the My AskAI WordPress plugin and allows an authenticated user with contributor-level access to insert arbitrary web scripts into the plugin’s shortcode attributes. This stored cross‑site scripting flaw causes the injected script to run whenever any user views a page that contains the vulnerable shortcode, enabling attackers to hijack user sessions, deface content, or exfiltrate data within the affected site. The weakness originates from insufficient input sanitization and missing output escaping, as identified in CWE‑79.

All installations of the My AskAI plugin for WordPress, up to and including version 1.0.0, are affected. The issue applies to the plugin’s shortcode handling regardless of the site's overall WordPress version.

With a CVSS score of 6.4 the flaw is considered moderate severity. The EPSS score of less than 1% suggests a low probability of widespread exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. However, the attack requires only contributor‑level authenticated access, which is commonly granted in collaborative sites, making exploitation relatively straightforward when the plugin is present and the shortcode is used. Once a payload is injected, it persists in the stored content and will run automatically for all users who view the affected page.