What is the CVSS score of CVE-2026-1886?

CVE-2026-1886 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-1886?

Organizations using all should be aware of moderate risk from CVE-2026-1886, a cross-site scripting vulnerability rated CVSS 6.4.

How to fix or mitigate CVE-2026-1886?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

WordPress CVE-2026-1886

EUVD-2026-13987 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-21 Wordfence

GHSA-74vj-5878-6g9m

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-13987

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:26 nvd

MEDIUM 6.4

DescriptionCVE.org

The Go Night Pro | WordPress Dark Mode Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'go-night-pro-shortcode' shortcode in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on the user-supplied 'margin' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

A Stored Cross-Site Scripting (XSS) vulnerability exists in the Go Night Pro WordPress Dark Mode Plugin affecting all versions up to and including 1.1.0, where the 'margin' attribute of the 'go-night-pro-shortcode' shortcode fails to properly sanitize and escape user input. Authenticated attackers with contributor-level access or above can inject arbitrary JavaScript code into pages, which executes when other users access the affected pages. This vulnerability carries a CVSS score of 6.4 (Medium) with network-based attack vector and low complexity, requiring valid WordPress credentials but affecting site-wide script execution with potential impact on user data and site integrity.

Technical ContextAI

The vulnerability is rooted in improper input handling within the Go Night Pro plugin's shortcode implementation, specifically in the 'go-night-shortcode-display.php' file at lines 48 and 61 as identified in the WordPress plugin repository. The vulnerability falls under CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic XSS weakness where user-supplied data enters the application through shortcode attributes without sufficient sanitization before being rendered in the DOM. The affected product is the Go Night Pro WordPress Dark Mode Plugin (CPE: cpe:2.3:a:hrs2015:go_night_pro_|_wordpress_dark_mode_plugin:*:*:*:*:*:*:*:*), which integrates into WordPress's shortcode parsing system. The 'margin' attribute is passed directly to HTML rendering without escaping functions like esc_attr() or sanitizing functions like sanitize_text_field(), allowing attackers to break out of attribute context and inject script tags or event handlers.

RemediationAI

Update the Go Night Pro WordPress Dark Mode Plugin to a version newer than 1.1.0 as soon as a patch is available from the plugin developer. Until an official update is released, WordPress administrators should immediately restrict the 'go-night-pro-shortcode' shortcode usage to trusted administrators only, or deactivate the plugin if dark mode functionality is not critical. Additionally, audit all existing pages and posts containing the 'go-night-pro-shortcode' shortcode for suspicious 'margin' attribute values, and consider using Web Application Firewall (WAF) rules to detect and block shortcode injection patterns targeting this plugin. Monitor the WordPress plugin repository and Wordfence threat intelligence feed (https://www.wordfence.com/threat-intel/vulnerabilities/id/4a75444e-b1e4-41e0-9209-07ded65c1498?source=cve) for security updates and implement them immediately upon availability.