CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
What the vulnerability does
Authenticated (admin user role) Persistent Cross-Site Scripting (XSS) in Mark Daniels Night Mode plugin <= 1.0.0 on WordPress via vulnerable parameters: &ntmode_page_setting[enable-me], &ntmode_page_setting[bg-color], &ntmode_page_setting[txt-color], &ntmode_page_setting[anc_color].
Explanation of Vulnerability in Simple Terms
The Night Mode WordPress plugin version 1.0.0 contains a stored cross-site scripting (XSS) vulnerability. An authenticated administrator can inject malicious JavaScript that executes in the browsers of other site users. The vulnerability requires an admin to intentionally craft a malicious input, and the injected code runs with the privileges of the user viewing the affected page.
What an attacker can do
Inject JavaScript that runs in other users' browsers when they view the site.
Potential impact on your site
A compromised admin account can inject malicious scripts affecting all site visitors, potentially stealing credentials or redirecting users.
Conditions required to exploit
Administrator account access and user interaction (victim must visit an affected page).
Key dates
External resources
Related vulnerabilities
