The Dark Mode – Improve Accessibility with AI Powered Dark Theme plugin for WordPress contains a stored cross‑site scripting vulnerability in the 'icon_light' shortcode attribute. Authenticated users with Contributor access or higher can inject arbitrary scripts into pages, which then execute for any visitor who loads the affected content. This enables the attacker to steal credentials, deface content, or distribute malware through the compromised site.

The vulnerability affects all installations of the Dark Mode – Improve Accessibility with AI Powered Dark Theme plugin up to and including version 5.3.17. Any WordPress site that has installed this plugin in those versions is potentially impacted.

The CVSS score is 6.4, indicating a moderate severity. The EPSS score is 0.00156 and the vulnerability is not listed in CISA's KEV catalog, so there is no public evidence of widespread exploitation. Attackers need site administrator or contributor privileges and the ability to edit content that includes the targeted shortcode. Once the scripts are stored, they execute automatically for all users who view the affected page, providing a persistent cross‑site scripting channel.