PT-2026-115417

CVE-2026-93535

Published

2026-10-16

Updated

2026-10-16

Description by

CVSS 3.1

6.4

Medium

MetricsAV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Dark Mode – Improve Accessibility with AI Powered Dark Theme versions prior to 5.3.18

Description Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting arbitrary web scripts through the icon light attribute of a shortcode, which then execute when a user visits the affected page.

Recommendations Update the plugin to a version newer than 5.3.17. Avoid using the icon light attribute in shortcodes until the update is applied.

Exploitability

Fix

Impacts

Researchers

Athiwat Tiprasaharn

Itthidej Aramsri

Suphakit Phrmduang

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers