EUVD-2026-13987
GHSA-74vj-5878-6g9m
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The Go Night Pro | WordPress Dark Mode Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'go-night-pro-shortcode' shortcode in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on the user-supplied 'margin' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
A Stored Cross-Site Scripting (XSS) vulnerability exists in the Go Night Pro WordPress Dark Mode Plugin affecting all versions up to and including 1.1.0, where the 'margin' attribute of the 'go-night-pro-shortcode' shortcode fails to properly sanitize and escape user input. Authenticated attackers with contributor-level access or above can inject arbitrary JavaScript code into pages, which executes when other users access the affected pages. This vulnerability carries a CVSS score of 6.4 (Medium) with network-based attack vector and low complexity, requiring valid WordPress credentials but affecting site-wide script execution with potential impact on user data and site integrity.
Technical ContextAI
The vulnerability is rooted in improper input handling within the Go Night Pro plugin's shortcode implementation, specifically in the 'go-night-shortcode-display.php' file at lines 48 and 61 as identified in the WordPress plugin repository. The vulnerability falls under CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic XSS weakness where user-supplied data enters the application through shortcode attributes without sufficient sanitization before being rendered in the DOM. The affected product is the Go Night Pro WordPress Dark Mode Plugin (CPE: cpe:2.3:a:hrs2015:go_night_pro_|_wordpress_dark_mode_plugin:*:*:*:*:*:*:*:*), which integrates into WordPress's shortcode parsing system. The 'margin' attribute is passed directly to HTML rendering without escaping functions like esc_attr() or sanitizing functions like sanitize_text_field(), allowing attackers to break out of attribute context and inject script tags or event handlers.
RemediationAI
Update the Go Night Pro WordPress Dark Mode Plugin to a version newer than 1.1.0 as soon as a patch is available from the plugin developer. Until an official update is released, WordPress administrators should immediately restrict the 'go-night-pro-shortcode' shortcode usage to trusted administrators only, or deactivate the plugin if dark mode functionality is not critical. Additionally, audit all existing pages and posts containing the 'go-night-pro-shortcode' shortcode for suspicious 'margin' attribute values, and consider using Web Application Firewall (WAF) rules to detect and block shortcode injection patterns targeting this plugin. Monitor the WordPress plugin repository and Wordfence threat intelligence feed (https://www.wordfence.com/threat-intel/vulnerabilities/id/4a75444e-b1e4-41e0-9209-07ded65c1498?source=cve) for security updates and implement them immediately upon availability.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today