The AI Feeds plugin for WordPress contains a stored cross‑site scripting flaw in the 'aife_post_meta' shortcode. Viewers of pages that use this shortcode can be presented with malicious script code when a contributor or higher‑privileged user injects a payload. This flaw arises from inadequate input sanitization and output escaping, allowing the attacker to execute arbitrary client‑side code in the context of other site visitors, potentially leading to session hijacking, defacement, or phishing.

All installations of AI Feeds version 1.0.22 or earlier are affected. The plugin is distributed by Soportecibeles and can be run on any WordPress site that includes this version of the plugin.

The vulnerability is rated CVSS 6.4, indicating moderate severity. EPSS is less than 1%, suggesting a low probability of exploitation at the time of assessment, and the flaw is not listed in CISA’s KEV catalog. However, because it is a stored XSS that requires authenticated Contributor‑level access, attackers who can obtain that permission could easily inject and persist malicious scripts that will run for all visitors of affected pages. Successful exploitation could compromise user accounts and the integrity of the site’s content.