Executive brief
The AI Share & Summarize plugin for WordPress, which provides social sharing and content summarization features, contains a security flaw in how it handles shortcodes. An attacker with a Contributor-level account can embed malicious scripts into a post. When a site administrator views that post, the script can automatically perform actions on their behalf, such as creating new unauthorized administrator accounts or stealing sensitive data.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability exists in the AI Share & Summarize plugin for WordPress due to insufficient sanitization and escaping of shortcode attributes, specifically the 'title_style' attribute within the 'ayudawp_share_buttons' shortcode. An authenticated attacker with at least Contributor-level privileges can inject malicious JavaScript into a post. When an administrative user views or previews the affected post, the payload executes in their browser context. This can be leveraged to perform unauthorized administrative actions, such as creating a new administrator user via the WordPress REST API or administrative interface. The issue is fixed in version 2.0.4.
Affected products
- Unknown AI Share & Summarize < 2.0.4
Timeline
- 2026-06-03: disclosed: Publicly published by WPScan
- 2026-06-24: advisory: NVD published date