CVE-2026-1886: Go Night Pro WordPress Plugin XSS Flaw

CVE-2026-1886 Overview

The Go Night Pro WordPress Dark Mode Plugin is vulnerable to Stored Cross-Site Scripting (XSS) through its go-night-pro-shortcode shortcode in all versions up to and including 1.1.0. The vulnerability exists due to insufficient input sanitization and output escaping on the user-supplied margin attribute. Authenticated attackers with contributor-level access or above can inject arbitrary web scripts into pages that execute whenever any user accesses the compromised page.

Critical Impact

Attackers with contributor-level WordPress access can persistently inject malicious scripts that execute in victims' browsers, potentially leading to session hijacking, credential theft, or unauthorized actions on behalf of authenticated users.

Affected Products

• Go Night Pro | WordPress Dark Mode Plugin versions up to and including 1.1.0
• WordPress installations utilizing the vulnerable plugin version
• Sites allowing contributor-level user access with the plugin active

Discovery Timeline

• 2026-03-21 - CVE-2026-1886 published to NVD
• 2026-03-23 - Last updated in NVD database

Technical Details for CVE-2026-1886

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability occurs within the shortcode processing functionality of the Go Night Pro plugin. The go-night-pro-shortcode shortcode accepts a margin attribute that is not properly sanitized before being rendered in the page output. When a user with contributor privileges or higher creates or edits content containing this shortcode, they can embed malicious JavaScript code within the margin attribute value.

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The stored nature of this XSS means the malicious payload persists in the WordPress database and executes every time any user—including administrators—views the affected page. This persistence significantly increases the attack surface and potential impact compared to reflected XSS variants.

Root Cause

The root cause stems from insufficient input sanitization and output escaping in the shortcode handler. The vulnerable code fails to properly sanitize the margin attribute before incorporating it into the HTML output. WordPress provides built-in escaping functions like esc_attr() and wp_kses() specifically designed to prevent XSS attacks, but these functions were not applied to the user-controllable attribute value before rendering.

The vulnerable code sections can be found in the plugin's shortcode display handler at admin/partials/shortcode/go-night-shortcode-display.php, specifically around lines 48 and 61 where the margin attribute is processed and output.

Attack Vector

The attack requires network access and authentication with at least contributor-level privileges on the WordPress site. An attacker would craft a malicious shortcode usage containing JavaScript in the margin attribute, such as embedding event handlers or script tags within the attribute value. Once the content containing this malicious shortcode is published or saved as a draft viewable by others, any user accessing that page would have the malicious script execute in their browser context.

The vulnerability does not require user interaction beyond normal page viewing, and the scope is changed—meaning scripts can affect resources beyond the vulnerable component's security context. This enables attacks like stealing session cookies, performing actions as the victim user, or redirecting users to malicious sites.

Detection Methods for CVE-2026-1886

Indicators of Compromise

• Unusual or obfuscated content within go-night-pro-shortcode shortcode attributes in WordPress posts or pages
• JavaScript event handlers (e.g., onerror, onload, onmouseover) appearing in shortcode margin attributes
• Unexpected <script> tags or JavaScript protocol handlers in post content containing the vulnerable shortcode
• User reports of unexpected browser behavior when viewing specific pages

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect XSS patterns in POST requests to WordPress content endpoints
• Monitor WordPress database for suspicious content patterns in post meta and content fields containing the shortcode
• Deploy browser-based Content Security Policy (CSP) headers to detect and block inline script execution attempts
• Review WordPress user activity logs for contributors creating content with unusual shortcode attribute values

Monitoring Recommendations

• Enable detailed logging for WordPress content creation and modification events
• Configure security plugins to scan existing content for potential XSS payloads in shortcode attributes
• Monitor client-side JavaScript errors that may indicate blocked XSS attempts due to CSP policies
• Regularly audit user accounts with contributor access or higher for suspicious activity patterns

How to Mitigate CVE-2026-1886

Immediate Actions Required

• Update the Go Night Pro plugin to a patched version if available from the plugin developer
• Review existing WordPress content for malicious shortcode usage and remove any suspicious payloads
• Audit contributor and author level user accounts and revoke access from any untrusted accounts
• Consider temporarily disabling the plugin until a patch is available if the risk is deemed unacceptable

Patch Information

Patch details should be obtained from the plugin developer. Organizations should monitor the Wordfence Vulnerability Report for updates on remediation status. The vulnerable code sections are documented in the WordPress Plugin SVN repository at lines 48 and 61 of the shortcode display handler.

Workarounds

• Implement strict Content Security Policy headers to mitigate the impact of any successful XSS exploitation
• Restrict contributor-level access to only trusted users who require content creation capabilities
• Use WordPress security plugins with XSS detection capabilities to monitor and block malicious content
• Consider implementing input validation at the server level using .htaccess or web server configuration rules

# Example Content Security Policy header configuration for Apache
# Add to .htaccess or virtual host configuration
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none';"

# For nginx, add to server block
# add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none';";