PLUGIN SECURITY
Known vulnerabilities, PHP compatibility and safer alternatives for the Wp Dark Mode WordPress plugin — checked against WP Clinic's local security database.
wp-dark-mode4 known CVEs on file for Wp Dark Mode. Reported between 2023 and 2024.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2024-5449 | WP Dark Mode – Improve Accessibility with AI Powered Dark Theme [wp-dark-mode] < 5.0.5 | Missing Authorization | Medium 4.3 | < 5.0.5 | 5.0.5 | 2024-06-05 | — |
| CVE-2022-47150 | WP Dark Mode – Improve Accessibility with AI Powered Dark Theme [wp-dark-mode] < 3.0.5 | Cross-Site Request Forgery (CSRF) | Medium 4.3 | < 3.0.5 | 3.0.5 | 2023-03-21 | — |
| CVE-2023-0467 | WP Dark Mode – Improve Accessibility with AI Powered Dark Theme [wp-dark-mode] < 4.0.8 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | Medium 4.3 | < 4.0.8 | 4.0.8 | 2023-03-06 | — |
| CVE-2022-4714 | WP Dark Mode – Improve Accessibility with AI Powered Dark Theme [wp-dark-mode] < 4.0.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 4.0.0 | 4.0.0 | 2023-01-30 | — |
The WP Dark Mode – WordPress Dark Mode Plugin for Improved Accessibility, Dark Theme, Night Mode, and Social Sharing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpdm_social_share_save_options function in all versions up to, and including, 5.0.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's settings.
Source: CVE.org
Update the WordPress WP Dark Mode – Best Dark Mode & Social Sharing Plugin for WordPress plugin to the latest available version (at least 3.0.5). Lana Codes discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress WP Dark Mode – Best Dark Mode & Social Sharing Plugin for WordPress Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. This vulnerability has been fixed in version 3.0.5.
Source: Patchstack
The WP Dark Mode plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 4.0.7 via the 'style' shortcode attribute. This allows authenticated attackers, with subscriber-level permissions and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. This only affects installations where the traversal of non-existent directories is allowed or when chained with another vulnerability that allows for the creation of arbitrary directories.
Source: Wordfence
Update the WordPress WP Dark Mode – Best Dark Mode & Social Sharing Plugin for WordPress plugin to the latest available version (at least 4.0.0). Lana Codes discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress WP Dark Mode – Best Dark Mode & Social Sharing Plugin for WordPress Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 4.0.0.
Source: Patchstack
Update this plugin to the latest release from wordpress.org — each CVE above lists the exact release that fixed it ("Fixed in") when one is on file.
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.