Stored Cross-Site Scripting Vulnerability in Dark Mode Plugin
CVE-2024-9118

6.4MEDIUM

Key Information:

Vendor
Wordpress
Status
Qs Dark Mode Plugin
Vendor
CVE Published:
1 October 2024

Summary

The QS Dark Mode Plugin for WordPress has a vulnerability that allows stored cross-site scripting through SVG file uploads due to inadequate input validation and output escaping mechanisms. Authenticated attackers with Author-level access or higher can exploit this flaw to inject arbitrary web scripts, which are executed when users access the compromised SVG files. This vulnerability presents a significant security risk, as it can lead to unauthorized actions and the exposure of sensitive user information.

Affected Version(s)

QS Dark Mode Plugin * <= 2.9

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://wordpress.org/plugins/qs-dark-mode/#developers
https://plugins.trac.wordpress.org/changeset/3159458/

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Francesco Carlucci
.