CVE-2018-5652

Name of the Vulnerable Software and Affected Versions dark-mode plugin version 1.6

Description A security issue was found in the dark-mode plugin for WordPress, where cross-site scripting (XSS) exists. This is due to the dark mode end parameter in the "wp-admin/profile.php" endpoint.

Recommendations For dark-mode plugin version 1.6, consider disabling the dark-mode plugin until a patch is available to prevent potential XSS attacks. Restrict access to the "wp-admin/profile.php" endpoint to minimize the risk of exploitation. Avoid using the dark mode end parameter in the affected endpoint until the issue is resolved.