CVE-2026-96870
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to and including 1.12.0 due to insufficient input sanitization and output escaping. An authenticated attacker with subscriber-level access or higher can inject arbitrary scripts that execute when a user hovers over a comment's like counter, as the tooltip handler assigns the attacker-controlled data-tooltip-description attribute value directly to innerHTML.
Risk Assessment
An attacker can execute arbitrary JavaScript in a user's browser, potentially leading to session theft, account takeover, or content modification. The risk affects community pages using this plugin.
Recommendation
Update the SureDash plugin to a version newer than 1.12.0. If no update is available, disable the plugin or restrict registration and commenting capabilities.
Other vulnerabilities in SureDash
See all- CVE-2026-57401Critical
The SureDash WordPress plugin contains a path traversal vulnerability that allows an attacker to access files outside the restricted directory. The issue affects versions up to and including 1.8.0.
- CVE-2026-115604Medium
Subscriber Arbitrary File Deletion in SureDash <= 1.12.3 versions.
- CVE-2026-115605Medium
Missing Authorization in the Brainstorm Force SureDash plugin allows exploitation of incorrectly configured access control security levels. This issue affects SureDash through version 1.12.3.
- CVE-2026-110881Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in the Brainstorm Force SureDash plugin allows Stored XSS. This issue affects SureDash through version 1.12.3.
- CVE-2026-110892Medium
The WordPress plugin 'SureDash' (versions up to 1.12.2) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. An attacker could perform actions they should not be authorized to do.
- CVE-2026-110894Medium
The SureDash plugin by Brainstorm Force is vulnerable to missing authorization, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 1.12.2.
- CVE-2026-110893Medium
The SureDash plugin by Brainstorm Force, versions up to 1.12.2, contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels.
- CVE-2026-102774Medium
The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute in Community Post Content in all versions up to and including 1.12.1 due to insufficient input sanitization and output escaping.
- CVE-2026-18402Medium
The SureDash – Community, Courses & Member Dashboard plugin for WordPress up to version 1.10.3 is vulnerable to Stored Cross-Site Scripting via the 'draweropenverposition' attribute. Authenticated attackers with contributor-level access and above can inject arbitrary scripts that execute when a user accesses the injected page. The payload is stored in JSON within an HTML comment, and missing esc_attr() allows breaking out of the attribute.
- CVE-2026-66698High
The SureDash plugin version 1.10.1 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser without requiring authentication.
Original NVD description (English source)
The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is triggered when any user hovers over a comment's like counter on a community page, as the plugin's tooltip handler assigns the attacker-controlled data-tooltip-description attribute value directly to innerHTML, re-parsing the browser-decoded entity payload as live HTML.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS