Skip to content
Sign in
4.3 Medium

CVE-2023-0467 The WP Dark Mode WordPress plugin before 4.0.8 does not properly sanitize the style parameter in shortcodes before using…

Description

The WP Dark Mode WordPress plugin before 4.0.8 does not properly sanitize the style parameter in shortcodes before using it to load a PHP template. This leads to Local File Inclusion on servers where non-existent directories may be traversed, or when chained with another vulnerability allowing arbitrary directory creation.

Affected products and versions

Product Affected versions Fixed in
WP Dark Mode 4.0 earliest → < 4.0.8 4.0.8

Other CVEs of WP Dark Mode

The 2 CVEs of WP Dark Mode →
CVE-2022-4714 The WP Dark Mode WordPress plugin before 4.0.0 does not validate and escape one of its shortcode attributes, which could… 5.4 Medium
Track this CVE