CVE-2026-93535: Stored XSS in The Dark Mode WordPress Plugin via the icon_light Shortcode Attribute

Summary

CVE-2026-93535 is a stored cross-site scripting (XSS) vulnerability, tracked as CWE-79, in "The Dark Mode – Improve Accessibility with AI Powered Dark Theme" plugin for WordPress. The flaw stems from insufficient input sanitization and output escaping in the plugin's handling of the icon_light shortcode attribute. All versions up to and including 5.3.17 are affected.

An authenticated attacker with Contributor-level access and above can inject arbitrary web scripts into pages, and those scripts execute whenever a user accesses an injected page. The published CVSS 3.1 base score is 6.4 (Medium), with the vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. According to the provided data, the vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. It was discovered by Athiwat Tiprasaharn (Jitlada), Itthidej Aramsri (Boeing777), and Suphakit Phrmduang (TORTY), with the CVE assigned by Wordfence.

Technical Analysis

The weakness is classified as CWE-79: improper neutralization of input during web page generation, the canonical cross-site scripting class. In this case the injection point is narrow and specific — the icon_light attribute of a shortcode registered by the plugin.

Two failures combine to produce the stored XSS condition, and the description names both explicitly:

Insufficient input sanitization. Values supplied to the icon_light shortcode attribute are not adequately cleaned when content is stored, so script markup supplied by the author survives into stored content.
Insufficient output escaping. When the shortcode is rendered, the attribute value is not adequately escaped for its output context, so stored markup is emitted into the page as executable content rather than as inert text.

Because the payload is stored with the content, this is stored (persistent) XSS rather than reflected XSS: the attacker plants the payload once, and every subsequent visitor to the injected page triggers execution. The description states this directly — the injected scripts "will execute whenever a user accesses an injected page."

The privilege requirement is a key part of the analysis. WordPress grants Contributor-level accounts the ability to author post content, and shortcodes embedded in that content are processed when the content is rendered. Since the vulnerability is reachable through a shortcode attribute, the attacker needs nothing more than the content-authoring capability a Contributor already holds. That is why the CVSS vector rates privileges required as low (PR:L) rather than none.

It is worth distinguishing the two failing controls, because they sit at different points in the data's lifecycle. Sanitization acts on the way in, when the attribute value is saved with the content; escaping acts on the way out, when the value is written into the rendered HTML. A robust implementation applies both, in the appropriate contexts. The description of CVE-2026-93535 indicates that at least one of these controls is missing or incomplete for this attribute, and cites insufficient sanitization and escaping together as the root cause.

Shortcode attributes are a frequent blind spot in WordPress plugin security reviews. A shortcode exists to make rich output easy for authors, so its attributes can be mistaken for trusted configuration rather than attacker-controlled input. CVE-2026-93535 is a reminder that any value a Contributor can type into a shortcode is attacker-controlled input, and it must be treated with the same rigor as a query parameter.

Reading the full CVSS 3.1 vector, AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N:

AV:N (Network): the vulnerability is exploitable over the network, here through normal WordPress content authoring and page viewing.
AC:L (Low): no unusual conditions are needed beyond a Contributor-level account and the plugin being installed at a vulnerable version.
PR:L (Low): Contributor-level access and above, exactly as the description states.
UI:N (None): the published vector rates user interaction as not required for exploitation.
S:C (Changed): the scope changes because the injected script executes in the browsers of other users. The attacker's influence extends beyond the content they are permitted to write, crossing a security boundary into the browsing sessions of whoever views the page.
C:L/I:L (Low/Low): low confidentiality and integrity impact, consistent with arbitrary script execution in the victim's browser context.
A:N (None): no availability impact is scored.

The description does not name the specific function, hook, or template code path inside the plugin where the attribute is rendered unsafely; those implementation details are not fully disclosed. Readers who need the code-level picture can consult the plugin's official trac changeset 3704136, which is listed among the references.

Affected Software and Versions

Product: The Dark Mode – Improve Accessibility with AI Powered Dark Theme, a plugin for WordPress.
Affected versions: all versions up to and including 5.3.17.
Fixed version: the description does not disclose an exact patched version number. Site owners should update to the latest available release, confirm it is newer than 5.3.17, and consult the referenced trac changeset 3704136 for the associated code change.
Weakness class: CWE-79 (cross-site scripting).
KEV status: false — not listed in CISA's Known Exploited Vulnerabilities catalog according to the provided data.

Impact

The direct impact is execution of arbitrary web scripts in the browser of any user who accesses an injected page. Because the injection is stored, a single successful injection persists: the attacker does not need to repeat any action for each victim, because the payload fires on every subsequent view of the affected content.

The CVSS scoring quantifies the impact as low for confidentiality (C:L) and low for integrity (I:L), with no availability impact (A:N). In practical terms, script running in a victim's browser within the page context can read and manipulate what that page presents and act within that context. The score reflects limited but real confidentiality and integrity consequences rather than a service-disrupting outcome.

The changed-scope designation (S:C) matters when weighing this impact. Even a script scored as low impact crosses a boundary: it runs in sessions the attacker never held, under the authority of users the attacker could not otherwise touch. The description states that scripts execute "whenever a user accesses an injected page" but does not enumerate which specific roles view the affected content or how the plugin's output is used across site templates; those details are not fully disclosed.

The Contributor-level gate also shapes exposure. On sites that allow public registration with Contributor capabilities, or that operate with many low-privileged authors, the population of users who could plant such a payload is larger than on tightly restricted sites. The description defines the attacker requirement but does not disclose any statistics about the plugin's install base or usage; those figures are not provided in the available data.

Exploitation Scenario

The following scenario is illustrative. It is derived strictly from the vulnerability description and published metadata; it is not a verified exploit chain, and some workflow details are not fully disclosed.

An attacker obtains an account with Contributor-level access (or higher) on a WordPress site running The Dark Mode plugin at version 5.3.17 or below.
The attacker authors content that includes the plugin's shortcode and supplies a crafted value for the icon_light attribute. Because input sanitization is insufficient, script markup embedded in that attribute value is stored with the content rather than neutralized.
When the content is rendered, insufficient output escaping means the stored markup is emitted into the page as live script rather than inert text.
Any user who accesses the injected page triggers execution of the attacker's script in their own browser, in the context of their own session — matching the changed scope and the low confidentiality and integrity impacts in the CVSS vector.

The description does not disclose whether the payload must survive a contributor review or publication workflow, or whether any additional plugin-side conditions apply; those details are not fully disclosed.

Detection and Mitigation

Detection

Determine whether the site runs The Dark Mode – Improve Accessibility with AI Powered Dark Theme and check the installed version. Every version up to and including 5.3.17 is affected.
Search stored content — posts, pages, and any other shortcode-bearing content — for uses of the icon_light attribute whose values contain script markup, event-handler text, or other unexpected characters.
Review recently created or edited content from Contributor-level accounts for shortcode usage that embeds markup in attribute values.

Mitigation

Update the plugin. Move to a release newer than 5.3.17. The exact patched version number is not stated in the description, so verify the installed version against the plugin's current release and consult the referenced trac changeset 3704136 for the code change.
Verify the fixed release through the plugin's official listing on WordPress.org and the referenced trac changeset, rather than assuming any particular version number, since the description does not disclose one.
Until the update is applied: restrict or closely review Contributor-level registrations, audit existing content for suspicious icon_light attribute values, and consider deactivating the plugin if immediate patching is not possible.
Keep exploitation in context: the provided data lists KEV status as false. Absence from the KEV catalog is not, by itself, evidence that exploitation has not occurred, so the detection steps above remain worthwhile.

Bug Bounty Angle

For bug bounty hunters, this CVE is a clean case study of a recurring WordPress pattern: stored XSS reachable through a single shortcode attribute from a low-privileged account. The entire vulnerability hinges on one attribute — icon_light — that was neither adequately sanitized on input nor escaped on output.

Test shortcode attributes systematically. When assessing a WordPress plugin as a Contributor-level user, enumerate the shortcodes the plugin registers and probe each attribute individually. This advisory shows that a single neglected attribute is enough for a scored CVE.
Check both directions. Verify sanitization on save and escaping on render separately. A value can be stored safely and still be emitted unsafely; the description of CVE-2026-93535 cites both insufficient sanitization and insufficient escaping.
Calibrate severity the way scoring bodies do. The 6.4 score with changed scope (S:C) and low privileges (PR:L) is a useful reference model when you write up your own low-privilege stored XSS findings.
Follow the advisory trail. The CVE was assigned by Wordfence, whose threat-intel entry is among the cited references, alongside the NVD entry, the plugin trac changeset, and the GitHub advisory GHSA-cfrj-fqm2-7frv. These are the sources worth monitoring for WordPress plugin vulnerability patterns.

When documenting a finding of this class, demonstrate the stored nature explicitly: show that the payload persists across sessions and fires for a second, unrelated account viewing the same content. That persistence, plus the absence of any interaction beyond a normal page view, is what justifies the changed-scope scoring reflected in this CVE's vector.

Frequently Asked Questions

What is CVE-2026-93535?

A stored cross-site scripting vulnerability in the WordPress plugin "The Dark Mode – Improve Accessibility with AI Powered Dark Theme", affecting all versions up to and including 5.3.17, via the icon_light shortcode attribute.

Who can exploit CVE-2026-93535?

Authenticated attackers with Contributor-level access and above. They can inject arbitrary web scripts into pages, which execute whenever a user accesses an injected page.

How severe is CVE-2026-93535?

CVSS 3.1 base score 6.4 (Medium), vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, classified CWE-79. It is not listed in CISA's KEV catalog according to the provided data.

How is CVE-2026-93535 fixed?

Update the plugin to a version newer than 5.3.17. The exact patched version is not disclosed; the referenced WordPress trac changeset 3704136 documents the code change.

Discovery and Credits: Discovered by Athiwat Tiprasaharn (Jitlada), Itthidej Aramsri (Boeing777), and Suphakit Phrmduang (TORTY); CVE assigned by Wordfence.