CVE-2026-110894

The SureDash WordPress plugin contains a path traversal vulnerability that allows an attacker to access files outside the restricted directory. The issue affects versions up to and including 1.8.0.

Subscriber Arbitrary File Deletion in SureDash <= 1.12.3 versions.

Missing Authorization in the Brainstorm Force SureDash plugin allows exploitation of incorrectly configured access control security levels. This issue affects SureDash through version 1.12.3.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in the Brainstorm Force SureDash plugin allows Stored XSS. This issue affects SureDash through version 1.12.3.

The WordPress plugin 'SureDash' (versions up to 1.12.2) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. An attacker could perform actions they should not be authorized to do.

The SureDash plugin by Brainstorm Force, versions up to 1.12.2, contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels.

The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to and including 1.12.0 due to insufficient input sanitization and output escaping. An authenticated attacker with subscriber-level access or higher can inject arbitrary scripts that execute when a user hovers over a comment's like counter, as the tooltip handler assigns the attacker-controlled data-tooltip-description attribute value directly to innerHTML.

The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute in Community Post Content in all versions up to and including 1.12.1 due to insufficient input sanitization and output escaping.

The SureDash – Community, Courses & Member Dashboard plugin for WordPress up to version 1.10.3 is vulnerable to Stored Cross-Site Scripting via the 'draweropenverposition' attribute. Authenticated attackers with contributor-level access and above can inject arbitrary scripts that execute when a user accesses the injected page. The payload is stored in JSON within an HTML comment, and missing esc_attr() allows breaking out of the attribute.

The SureDash plugin version 1.10.1 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser without requiring authentication.