Ayo Shortcodes plugin for WordPress has a stored cross‑site scripting vulnerability in the 'color' parameter of the ayo_action shortcode. The flaw arises from missing sanitization and escaping, enabling an authenticated Contributor or higher to embed arbitrary JavaScript that will run whenever any user views the affected page. Such scripts can hijack sessions, alter page content, exfiltrate data, or redirect users to malicious sites, representing a typical stored XSS impact on confidentiality, integrity, and availability of all visitors to the site.

The issue affects Ayo Themes’ Ayo Shortcodes plugin in all releases up to and including version 0.2. Any WordPress site running this plugin without a post‑0.2 update is vulnerable. Versions beyond 0.2 are assumed fixed, unless further information reveals otherwise.

The CVSS score of 6.4 classifies this as a medium‑severity flaw, and the current EPSS score of <1 % indicates a very low probability of exploitation in the wild. However, the vulnerability requires the attacker to hold at least Contributor privileges, which are common on many blogs and small business sites, meaning that any compromise of such accounts can be sufficient. The flaw is not listed in the CISA KEV catalog, implying no publicly confirmed exploits, but stored XSS still remains a legitimate risk for attackers who can inject and persist malicious content.