Dark Mode Improve Accessibility With Ai Powered Dark Theme
Monthly
Stored cross-site scripting in the WPPool 'Dark Mode - Improve Accessibility with AI Powered Dark Theme' WordPress plugin (all versions up to and including 5.3.17) allows attackers holding a Contributor-level account or higher to inject arbitrary JavaScript via the 'icon_light' shortcode attribute, which then executes in the browser of any visitor who later loads the injected page. Authentication is required and the privilege gate is Contributor-and-above (CVSS vector PR:L, scope changed), so sites that tightly control or disable self-registration and editorial roles are largely insulated. No public exploit code and no confirmed active exploitation have been identified at time of analysis; EPSS and KEV data were not provided.
Stored cross-site scripting in the WPPool 'Dark Mode - Improve Accessibility with AI Powered Dark Theme' WordPress plugin (all versions up to and including 5.3.17) allows attackers holding a Contributor-level account or higher to inject arbitrary JavaScript via the 'icon_light' shortcode attribute, which then executes in the browser of any visitor who later loads the injected page. Authentication is required and the privilege gate is Contributor-and-above (CVSS vector PR:L, scope changed), so sites that tightly control or disable self-registration and editorial roles are largely insulated. No public exploit code and no confirmed active exploitation have been identified at time of analysis; EPSS and KEV data were not provided.