The AI Share & Summarize WordPress plugin fails to sanitize and escape specific shortcode attributes before rendering them. This flaw enables users who possess the Contributor role or higher to inject malicious JavaScript into page content. Stored XSS means the injected code persists across page loads, potentially allowing attackers to deface the site, steal user credentials, hijack sessions, or execute other client‑side attacks on visitors who view the affected content.

Any WordPress site that has installed AI Share & Summarize prior to release 2.0.4 is vulnerable. The issue is specific to the plugin; all other WordPress components are unaffected.

The vulnerability has a medium severity rating of CVSS 5.4, reflecting a moderate risk to site visitors. The EPSS score is less than 1%, indicating a low probability of exploitation, but the flaw remains enabled for users with Contributor privileges, allowing them to inject persistent malicious JavaScript. The defect is not listed in the CISA KEV catalog, yet sites that rely heavily on user‑generated content remain at risk.