The AI Share & Summarize WordPress plugin fails to sanitize and escape specific shortcode attributes before rendering them. This flaw enables users who possess the Contributor role or higher to inject malicious JavaScript into page content. Stored XSS means the injected code persists across page loads, potentially allowing attackers to deface the site, steal user credentials, hijack sessions, or execute other client‑side attacks on visitors who view the affected content.

Any WordPress site that has installed AI Share & Summarize prior to release 2.0.4 is vulnerable. The issue is specific to the plugin; all other WordPress components are unaffected.

The vulnerability has a high severity because it allows persistence and impact on confidentiality, integrity, and availability of site visitors. EPSS information is not available, so the exact exploitation probability cannot be quantified, but the lack of input sanitization is a classic, well‑understood weakness, suggesting that exploitation is plausible for an attacker who can leverage the Contributor role. The defect is not listed in the CISA KEV catalog, yet sites that rely heavily on user‑generated content are still at risk.