CVE-2025-47628

Missing Authorization vulnerability in quomodosoft QS Dark Mode qs-dark-mode allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects QS Dark Mode: from n/a through <= 3.0.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://patchstack.com/database/Wordpress/Plugin/qs-dark-mode/vulnerability/wordpress-qs-dark-mode-3-0-broken-access-control-vulnerability?_s_id=cve	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:quomodosoft:qs_dark_mode:*:*:*:*:*:wordpress:*:*

History

No history.

Information

Published : 2025-05-07 15:16

Updated : 2026-06-17 09:28

NVD link : CVE-2025-47628

Mitre link : CVE-2025-47628

CVE.ORG link : CVE-2025-47628

JSON object : View

Products Affected

quomodosoft

qs_dark_mode

CWE

CWE-862

Missing Authorization

{"id": "CVE-2025-47628", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-47628", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-05-08T15:18:44.579249Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "audit@patchstack.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "audit@patchstack.com", "affectedData": [{"vendor": "quomodosoft", "product": "QS Dark Mode", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "3.0"}], "packageName": "qs-dark-mode", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}]}], "published": "2025-05-07T15:16:15.990", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/qs-dark-mode/vulnerability/wordpress-qs-dark-mode-3-0-broken-access-control-vulnerability?_s_id=cve", "tags": ["Third Party Advisory"], "source": "audit@patchstack.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "audit@patchstack.com", "description": [{"lang": "en", "value": "CWE-862"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in quomodosoft QS Dark Mode qs-dark-mode allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects QS Dark Mode: from n/a through <= 3.0."}, {"lang": "es", "value": "La vulnerabilidad de falta de autorizaci\u00f3n en quomodosoft QS Dark Mode permite explotar niveles de seguridad de control de acceso configurados incorrectamente. Este problema afecta al modo oscuro de QS desde la versi\u00f3n n/d hasta la 3.0."}], "lastModified": "2026-06-17T09:28:25.777", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:quomodosoft:qs_dark_mode:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "7F1906FB-46C5-4664-98C3-0A6FD949E1FC", "versionEndIncluding": "3.0"}], "operator": "OR"}]}], "sourceIdentifier": "audit@patchstack.com"}