Stored Cross-Site Scripting Vulnerability in Dark Mode Plugin

CVE-2024-9118

What is CVE-2024-9118?

The QS Dark Mode Plugin for WordPress has a vulnerability that allows stored cross-site scripting through SVG file uploads due to inadequate input validation and output escaping mechanisms. Authenticated attackers with Author-level access or higher can exploit this flaw to inject arbitrary web scripts, which are executed when users access the compromised SVG files. This vulnerability presents a significant security risk, as it can lead to unauthorized actions and the exposure of sensitive user information.

References