The Go Night Pro WordPress plugin allows an authenticated contributor or higher to inject arbitrary JavaScript via the 'margin' attribute in its shortcode. Because the plugin does not properly sanitize or escape this input, the malicious script is stored as part of page content. When a visitor loads the affected page, the payload executes in their browser, enabling cookie theft, phishing, or other XSS attacks. This weakness corresponds to CWE‑79: Improper Neutralization of Input During Web Page Generation.

WordPress sites running the Go Night Pro Dark Mode plugin version 1.1.0 or earlier are affected. Any site where contributors have permission to edit content and use the shortcode is vulnerable. Site administrators should check the installed plugin version and upgrade if it is 1.1.0 or lower.

With a CVSS score of 6.4 the vulnerability carries a medium‑to‑high severity. An attacker needs only contributor‑level access, a capability commonly granted in WordPress installations. Once a stored XSS payload is injected, it executes for every viewer of the page, potentially compromising user sessions and sensitive data. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, so the current exploit probability is uncertain, but the impact to exposed sites is significant.