CVE-2026-93535

MediumCVSS 6.4/10Last modified Oct 16, 2026

Description

The Dark Mode – Improve Accessibility with AI Powered Dark Theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'icon_light' Shortcode Attribute in all versions up to, and including, 5.3.17 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Oct 16, 2026
Last modified
Oct 16, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-935376.5A user who can supply bundle content to a repository referenced by a GitRepo resource, for example through Git push access, or through permiCVE-2026-935387.1A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated cluster registration, cluster labels supplieCVE-2026-935395.4A vulnerability was discovered in Fleet's Git webhook receiver (the gitjob webhook service). When a webhook secret is not configured, incomiCVE-2026-93546.5A vulnerability was detected in NousResearch hermes-agent up to 2026.4.16. The affected element is an unknown function of the component SlacCVE-2026-935406.5A privilege mismatch was found in Fleet. When a bundle requested namespace labels or annotations through the namespaceLabels and namespaceAnCVE-2026-935416.5An out-of-bounds read in libXi's XQueryDeviceState() in libXi before 1.8.4 could be used by aCVE-2026-935426.5An out-of-bounds read in libXi's XI2 class parsing via size_classes() and copy_classes() in libXi before 1.8.4 could be used by malicous serCVE-2026-935437.4An out-of-bounds read in libXi's XI2 class parser in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.CVE-2026-935446.5An out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing in libXi before 1.8.4 can be used by a malicious X server to crash an attacCVE-2026-935456.5An out-of-bounds read in libXi's XListInputDevices() in libXi before 1.8.4 could be used by malicious X servers to crash an attached X clienCVE-2026-935468.8Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker CVE-2026-935475.3A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet