rootpwn

medium · CVSS v3 6.4 · EPSS 0.00156

CVE-2026-93535

The Dark Mode – Improve Accessibility with AI Powered Dark Theme plugin for WordPress contains a stored XSS flaw in the 'icon_light' shortco

Overview

The Dark Mode – Improve Accessibility with AI Powered Dark Theme plugin for WordPress contains a stored XSS flaw in the 'icon_light' shortcode attribute. Authenticated users with Contributor or higher privileges can inject malicious scripts that run for any visitor to the affected page. This flaw allows attackers to execute arbitrary JavaScript in the context of the site’s front‑end.

Description

The Dark Mode – Improve Accessibility with AI Powered Dark Theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'icon_light' Shortcode Attribute in all versions up to, and including, 5.3.17 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Impact

Confidentiality: attackers can exfiltrate sensitive data via injected scripts. Integrity: malicious code can modify page content or redirect users. Availability: repeated exploitation may degrade user experience. Defenders include site administrators, security teams, and WordPress developers.

Remediation

1. Update the plugin to the latest version (5.3.18 or newer) where the 'icon_light' attribute is properly sanitized and escaped. 2. If an update is not immediately possible, disable the plugin or remove the shortcode from all posts and pages. 3. Restrict Contributor role permissions to prevent them from editing content that includes shortcodes, or enforce a stricter role hierarchy. 4. Deploy a Web Application Firewall (WAF) rule to block suspicious script payloads in shortcode attributes.

Risk context

The CVE has a medium severity score (CVSS 3.0: 6.4) and a very low EPSS of 0.00156, indicating a moderate but not urgent risk. Defenders should prioritize the patch but can monitor for exploitation attempts while awaiting the update.

Affected products

  • WordPress Dark Mode – Improve Accessibility with AI Powered Dark Theme 5.3.17

Scores

Severity
medium
CVSS v2
5.5
CVSS v3
6.4
CVSS v4
—
EPSS
0.00156

wordpress plugin xss stored contributor dark-mode accessibility

← All CVEs

Related CVEs

medium

CVE-2026-100158

The SQL Chart Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-axis column value ($value->$xarg_s from $wpdb->get_results())' parameter in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have published a chart whose SQL query returns a column controllable by a lower-privileged user, such as wp_users.display_name, which a Subscriber can populate with a payload via the standard WordPress profile page at /wp-admin/profile.php.

View analysis

medium

CVE-2026-109382

The WSP MCP AI Agents Connector plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.9.5. This is due to the wsp_get_posts MCP tool being registered with an empty capability requirement while the MCP endpoint's authenticate() method accepts any logged-in user, and the wsp_execute_get_posts() callback honouring a caller-supplied status=all argument that expands into a WP_Query over 'publish', 'draft', 'pending' and 'future' posts with no author or ownership filter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the titles, URLs, authors, categories, tags and 40-word excerpts of every unpublished (draft/pending/scheduled) post on the site.

View analysis

medium

CVE-2026-109982

The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.2 does not perform a capability check or validate a nonce on its migration actions, allowing any authenticated user, such as a subscriber, to trigger a one-way migration that creates published records and permanently deletes a companion MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.2's entire post-type and taxonomy configuration.

View analysis

medium

CVE-2026-19798

The Wp Map Block plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the set_status() and bulk() functions in the Maps_Controller REST controller in versions up to, and including, 3.0.0. The plugin's permission_callback (can_edit()) only verifies current_user_can('edit_posts') and performs no object-level ownership check or verification of publish-level capabilities, while the handlers pass the caller-controlled map ID directly to wp_update_post() (and wp_delete_post() in the bulk delete branch) to change post_status between publish and draft. This makes it possible for authenticated attackers, with Contributor-level access and above, to publish or unpublish (and bulk-delete) any wpmb_map post, including maps owned by administrators, which hides published maps from all public pages site-wide or forces draft maps to become publicly visible.

View analysis