SureDash CVE-2026-110881

Exploitation requires an authenticated account on the target WordPress site with at least low-privilege access able to submit input that SureDash stores and renders (PR:L), plus interaction by a victim user who loads the affected page (UI:R). The specific SureDash field, feature, or admin view that fails to neutralize input is not described in the available source, so the exact injection point should be confirmed from the Patchstack advisory. Limiting factors: the attacker needs valid credentials/a role permitted to write the stored content, a separate victim must view the content for the payload to fire, and impact is bounded to the plugin's affected pages; this is not remote-unauthenticated and does not work against a site where untrusted users cannot obtain posting accounts.

This is a medium-severity stored XSS (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) in the SureDash WordPress plugin, reported by Patchstack. The vector requires authenticated access (PR:L) and victim user interaction (UI:R), which materially lowers real-world risk versus an unauthenticated drive-by flaw; the scope change (S:C) reflects script executing in the context of other users' browser sessions, which is why confidentiality/integrity impacts are assessed as Low rather than None. No EPSS score, no CISA KEV listing, and no verified public exploit are present in the input, and the SSVC/priority signal is 'this_month' (not act_now/emergency) - all consistent with a real but non-urgent, lower-probability issue rather than a widely-exploited critical bug. The single reference is the Patchstack vulnerability database entry (a research advisory), not independent vendor confirmation; affected-version boundaries ('from n/a through 1.12.3') and the absence of a stated fixed version should be verified directly with Brainstorm Force.

A low-privileged authenticated user (e.g., a contributor or author role) injects a malicious script payload into a SureDash input field that is stored and later rendered. When a higher-privileged user such as an administrator views the affected dashboard page, the stored script executes in their browser session, potentially performing actions as that user. No verified public exploit code was identified; exploitation requires both authentication and victim interaction (AC:L/PR:L/UI:R).