CVE-2026-10531

AI Share & Summarize < 2.0.4 - Contributor+ Stored XSS via title_style Shortcode Attribute

View on CVE.org
Published Jun 24, 2026 CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Description
The AI Share & Summarize WordPress plugin before 2.0.4 does not sanitise and escape some of its shortcode attributes before outputting them in a page, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.

Analysis

AI-generated

Technical impact

The AI Share & Summarize WordPress plugin fails to sanitize and escape specific shortcode attributes before rendering them. This flaw enables users who possess the Contributor role or higher to inject malicious JavaScript into page content. Stored XSS means the injected code persists across page loads, potentially allowing attackers to deface the site, steal user credentials, hijack sessions, or execute other client‑side attacks on visitors who view the affected content.

Affected Systems

Any WordPress site that has installed AI Share & Summarize prior to release 2.0.4 is vulnerable. The issue is specific to the plugin; all other WordPress components are unaffected.

Risk and Exploitability

The vulnerability has a medium severity rating of CVSS 5.4, reflecting a moderate risk to site visitors. The EPSS score is less than 1%, indicating a low probability of exploitation, but the flaw remains enabled for users with Contributor privileges, allowing them to inject persistent malicious JavaScript. The defect is not listed in the CISA KEV catalog, yet sites that rely heavily on user‑generated content remain at risk.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade AI Share & Summarize to version 2.0.4 or later
  • Restrict the use of the shortcode to administrators or remove it from posts created by contributors
  • If the plugin is no longer required, deactivate or uninstall it

Generated by OpenCVE AI on June 24, 2026 at 16:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Ai Share And Summarize
Ai Share And Summarize ai Share And Summarize
Wordpress
Wordpress wordpress
Weaknesses CWE-79
Vendors & Products Ai Share And Summarize
Ai Share And Summarize ai Share And Summarize
Wordpress
Wordpress wordpress
Type Values Removed Values Added
Weaknesses CWE-79
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Weaknesses CWE-79
Type Values Removed Values Added
Description The AI Share & Summarize WordPress plugin before 2.0.4 does not sanitise and escape some of its shortcode attributes before outputting them in a page, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
Title AI Share & Summarize < 2.0.4 - Contributor+ Stored XSS via title_style Shortcode Attribute
References
Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Sources

Status
PUBLISHED
Assigner
WPScan
Published
Updated
Jun 24, 2026, 12:23 PM
Reserved
Jun 1, 2026, 11:15 AM

View source JSON

Updated
Jun 24, 2026, 12:22 PM

JSON

Status
Deferred
Published
Jun 24, 2026, 7:16 AM
Modified
Jun 25, 2026, 7:07 PM

View source JSON

No data.

Updated
Jun 24, 2026, 4:30 PM

JSON