Stored Cross-Site Scripting Vulnerability in Dark Mode Plugin for WordPress
CVE-2026-93535

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
Dark Mode – Improve Accessibility With Ai Powered Dark Theme
Vendor
CVE Published:
16 October 2026

What is CVE-2026-93535?

The Dark Mode – Improve Accessibility with AI Powered Dark Theme plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping. This vulnerability affects all versions up to and including 5.3.17, enabling authenticated attackers with Contributor-level access or higher to embed arbitrary web scripts. These scripts will execute whenever a user visits an affected page, potentially leading to unauthorized data access and compromise.

Affected Version(s)

Dark Mode – Improve Accessibility with AI Powered Dark Theme 0 <= 5.3.17

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/3704136/

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Athiwat Tiprasaharn (Jitlada)
Itthidej Aramsri (Boeing777)
Suphakit Phrmduang (TORTY)
.