Wp Dark Mode Vulnerabilities

[en] The WP Dark Mode – WordPress Dark Mode Plugin for Improved Accessibility, Dark Theme, Night Mode, and Social Sharing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpdm_social_share_save_options function in all versions up to, and including, 5.0.4....

Affected:

up to 5.0.5

Fixed in:

5.0.5

Disclosed:

Jun 6, 2024

CVE-2024-5449 on NVD →

The WP Dark Mode – WordPress Dark Mode Plugin for Improved Accessibility, Dark Theme, Night Mode, and Social Sharing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpdm_social_share_save_options function in all versions up to, and including, 5.0.4. This...

CVSS:

4.3

Affected:

up to 5.0.4

Fixed in:

5.0.5

Disclosed:

Jun 5, 2024

CVE-2024-5449 on NVD →

[en] The WP Dark Mode WordPress plugin before 4.0.8 does not properly sanitize the style parameter in shortcodes before using it to load a PHP template. This leads to Local File Inclusion on servers where non-existent directories may be traversed, or when chained with another vulnerability allowing arbitrary directory...

Affected:

up to 4.0.8

Fixed in:

4.0.8

Disclosed:

Mar 27, 2023

CVE-2023-0467 on NVD →

The WP Dark Mode plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 4.0.7 via the 'style' shortcode attribute. This allows authenticated attackers, with subscriber-level permissions and above, to include and execute arbitrary files on the server, allowing the execution of any P...

CVSS:

8.8

Affected:

up to 4.0.7

Fixed in:

4.0.8

Disclosed:

Mar 6, 2023

CVE-2023-0467 on NVD →

[en] The WP Dark Mode WordPress plugin before 4.0.0 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack

Affected:

up to 4.0.0

Fixed in:

4.0.0

Disclosed:

Feb 21, 2023

CVE-2022-4714 on NVD →

The WP Dark Mode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor level and...

CVSS:

6.4

Affected:

up to 3.0.6

Fixed in:

4.0.0

Disclosed:

Jan 30, 2023

CVE-2022-4714 on NVD →

The Appsero analytics tool used in several plugins is vulnerable to authorization bypass due to a missing capability check on the uninstall_reason_submission function used for feedback submission in versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with subscriber-level permissio...

CVSS:

4.3

Affected:

up to 3.0.4

Fixed in:

3.0.5

Disclosed:

Dec 16, 2022

The Appsero analytics tool used in several plugins is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the uninstall_reason_submission function used for feedback submission in versions up to, and including, 1.2.0. This makes it possible for unauthenticated attackers to invoke this function inten...

CVSS:

4.3

Affected:

up to 3.0.4

Fixed in:

3.0.5

Disclosed:

Dec 14, 2022

CVE-2022-47150 on NVD →

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Affected:

up to 3.0.5

Fixed in:

3.0.5

CVE-2022-47150 on NVD →