CVE-2022-29418

MEDIUM 4.8CVE-2022-29418 · Published 25/04/2022 · updated 17/06/2026

In short

CVE-2022-29418 is a MEDIUM (CVSS 4.8) vulnerability affecting night mode (night mode project).
Chance of exploitation in the next 30 days (EPSS): 0.54%, higher than 45.6% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
night mode night_mode_project	`≤ 1.0.0`	No fix yet

Description

Authenticated (admin user role) Persistent Cross-Site Scripting (XSS) in Mark Daniels Night Mode plugin <= 1.0.0 on WordPress via vulnerable parameters: &ntmode_page_setting[enable-me], &ntmode_page_setting[bg-color], &ntmode_page_setting[txt-color], &ntmode_page_setting[anc_color].

References

patchstack.com/database/vulnerability/night-mode/wordpress-night-mode-plugin-1-0-0-authenticated-persistent-cross-site-scripting-xss-vulnerability · Third Party Advisory
wordpress.org/plugins/night-mode · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free