{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1886", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-04T14:21:05.709Z", "datePublished": "2026-03-21T03:26:44.759Z", "dateUpdated": "2026-03-23T17:23:01.713Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-03-21T03:26:44.759Z"}, "affected": [{"vendor": "hrs2015", "product": "Go Night Pro | WordPress Dark Mode Plugin", "versions": [{"version": "*", "status": "affected", "lessThanOrEqual": "1.1.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Go Night Pro | WordPress Dark Mode Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'go-night-pro-shortcode' shortcode in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on the user-supplied 'margin' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Go Night Pro | WordPress Dark Mode Plugin <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'margin' Shortcode Attribute", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4a75444e-b1e4-41e0-9209-07ded65c1498?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/go-night-pro/trunk/admin/partials/shortcode/go-night-shortcode-display.php#L48"}, {"url": "https://plugins.trac.wordpress.org/browser/go-night-pro/tags/1.1.0/admin/partials/shortcode/go-night-shortcode-display.php#L48"}, {"url": "https://plugins.trac.wordpress.org/browser/go-night-pro/trunk/admin/partials/shortcode/go-night-shortcode-display.php#L61"}, {"url": "https://plugins.trac.wordpress.org/browser/go-night-pro/tags/1.1.0/admin/partials/shortcode/go-night-shortcode-display.php#L61"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Djaidja Moundjid"}], "timeline": [{"time": "2026-03-20T15:10:52.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-23T17:22:53.984857Z", "id": "CVE-2026-1886", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T17:23:01.713Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1886", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-23T17:22:53.984857Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T17:22:57.818Z"}}], "cna": {"title": "Go Night Pro | WordPress Dark Mode Plugin <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'margin' Shortcode Attribute", "credits": [{"lang": "en", "type": "finder", "value": "Djaidja Moundjid"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "hrs2015", "product": "Go Night Pro | WordPress Dark Mode Plugin", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.1.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-03-20T15:10:52.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4a75444e-b1e4-41e0-9209-07ded65c1498?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/go-night-pro/trunk/admin/partials/shortcode/go-night-shortcode-display.php#L48"}, {"url": "https://plugins.trac.wordpress.org/browser/go-night-pro/tags/1.1.0/admin/partials/shortcode/go-night-shortcode-display.php#L48"}, {"url": "https://plugins.trac.wordpress.org/browser/go-night-pro/trunk/admin/partials/shortcode/go-night-shortcode-display.php#L61"}, {"url": "https://plugins.trac.wordpress.org/browser/go-night-pro/tags/1.1.0/admin/partials/shortcode/go-night-shortcode-display.php#L61"}], "descriptions": [{"lang": "en", "value": "The Go Night Pro | WordPress Dark Mode Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'go-night-pro-shortcode' shortcode in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on the user-supplied 'margin' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-03-21T03:26:44.759Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1886", "state": "PUBLISHED", "dateUpdated": "2026-03-23T17:23:01.713Z", "dateReserved": "2026-02-04T14:21:05.709Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-21T03:26:44.759Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Go Night Pro | WordPress Dark Mode Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'go-night-pro-shortcode' shortcode in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on the user-supplied 'margin' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "id": "CVE-2026-1886", "lastModified": "2026-03-23T14:32:02.800", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Primary"}]}, "published": "2026-03-21T04:16:55.523", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/go-night-pro/tags/1.1.0/admin/partials/shortcode/go-night-shortcode-display.php#L48"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/go-night-pro/tags/1.1.0/admin/partials/shortcode/go-night-shortcode-display.php#L61"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/go-night-pro/trunk/admin/partials/shortcode/go-night-shortcode-display.php#L48"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/go-night-pro/trunk/admin/partials/shortcode/go-night-shortcode-display.php#L61"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4a75444e-b1e4-41e0-9209-07ded65c1498?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Go Night Pro | WordPress Dark Mode Plugin", "source": "cna", "vendor": "hrs2015"}, "product": "go_night_pro_|_wordpress_dark_mode_plugin", "vendor": "hrs2015"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-21T06:25:11.121829+00:00", "value": {"mitigation_remediation": ["Upgrade the Go Night Pro plugin to the latest available version (\u2265\u202f1.1.1).", "If an upgrade is not yet available, remove the plugin or disable use of the 'go-night-pro-shortcode' on all pages.", "Restrict contributor roles to only the minimum capabilities required for content creation, or revoke the ability to edit posts that include the shortcode.", "Implement a web\u2011application firewall or content\u2011security\u2011policy that blocks unexpected JavaScript injection on the site."], "summary": {"action": "Patch", "impact": "Stored cross\u2011site scripting (XSS)"}, "threat_synthesis": {"affected_systems": "WordPress sites running the Go Night Pro Dark Mode plugin version\u202f1.1.0 or earlier are affected. Any site where contributors have permission to edit content and use the shortcode is vulnerable. Site administrators should check the installed plugin version and upgrade if it is 1.1.0 or lower.", "description_and_impact": "The Go Night Pro WordPress plugin allows an authenticated contributor or higher to inject arbitrary JavaScript via the 'margin' attribute in its shortcode. Because the plugin does not properly sanitize or escape this input, the malicious script is stored as part of page content. When a visitor loads the affected page, the payload executes in their browser, enabling cookie theft, phishing, or other XSS attacks. This weakness corresponds to CWE\u201179: Improper Neutralization of Input During Web Page Generation.", "risk_and_exploitability": "With a CVSS score of 6.4 the vulnerability carries a medium\u2011to\u2011high severity. An attacker needs only contributor\u2011level access, a capability commonly granted in WordPress installations. Once a stored XSS payload is injected, it executes for every viewer of the page, potentially compromising user sessions and sensitive data. The EPSS score is not available and the vulnerability is not listed in CISA\u2019s KEV catalog, so the current exploit probability is uncertain, but the impact to exposed sites is significant."}}}}, "created": "2026-03-23T09:50:42.277233+00:00", "updated": "2026-03-25T14:42:15.392954+00:00", "vendors": ["hrs2015", "hrs2015$PRODUCT$go_night_pro_|_wordpress_dark_mode_plugin", "wordpress", "wordpress$PRODUCT$wordpress"]}