What is the CVSS score of CVE-2026-18402?

CVE-2026-18402 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

SureDash CVE-2026-18402

EUVD-2026-59895 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-08-16 Wordfence

GHSA-7f7r-rggw-cgcr

WordPress XSS Wordpress Plugin Suredash Community Courses Member Dashboard Brainstormforce

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

UI:R applied because stored XSS impact requires a victim to visit the injected page; all other metrics align with the provided vector.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 16, 2026 - 06:16 vuln.today

CVE Published

Aug 16, 2026 - 05:27 cve.org

MEDIUM 6.4

DescriptionCVE.org

The SureDash - Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'draweropenverposition' Block/Shortcode Attribute in all versions up to, and including, 1.10.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is stored inside the block-delimiter HTML comment's JSON, which wp_kses_post does not neutralize on save, and is only interpolated into the rendered style attribute at display time without esc_attr() escaping, allowing a double-quote to break out of the attribute and introduce arbitrary HTML event handlers.

AnalysisAI

Stored Cross-Site Scripting in the SureDash WordPress plugin (versions up to and including 1.10.3) allows authenticated contributor-level users to persist malicious scripts via the 'draweropenverposition' block/shortcode attribute. The flaw is exploitable because the plugin stores raw attribute values inside block-delimiter HTML comment JSON, which WordPress's wp_kses_post filter does not sanitize on save; at render time the value is interpolated into a style attribute without esc_attr() escaping, enabling a double-quote to escape the attribute context and inject arbitrary HTML event handlers. No public exploit has been identified at time of analysis, and no KEV listing is present, but the low privilege barrier (contributor role) makes this a realistic threat on any multi-author or membership WordPress site.

Technical ContextAI

The vulnerability resides in the SureDash plugin (CPE: cpe:2.3:a:brainstormforce:suredash_-_community,_courses_&_member_dashboard:*:*:*:*:*:*:*:*) developed by Brainstormforce, a prolific WordPress plugin vendor. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a stored XSS variant. WordPress's wp_kses_post is a server-side sanitization function that strips disallowed HTML tags and attributes; however, it does not inspect or sanitize values stored inside Gutenberg block-delimiter HTML comments, which are treated as opaque JSON metadata by WordPress core. The plugin reads the 'draweropenverposition' attribute from this JSON store at display time and writes it directly into a rendered HTML style attribute in view.php (confirmed at notification.php lines 182, 189 and view.php line 26 in the 1.10.3 tag on the WordPress SVN trac). Because esc_attr() is not applied at output, a double-quote character in the attacker's payload can terminate the style attribute value and introduce additional HTML attributes or event handlers (e.g., onerror, onclick), causing arbitrary JavaScript execution in any visitor's browser.

RemediationAI

An upstream code fix is available via the WordPress plugin SVN changeset (plugins.trac.wordpress.org/changeset referencing revision 3632516 of suredash); however, a released patched plugin version is not independently confirmed in the available data - administrators should check the WordPress plugin repository for a version newer than 1.10.3 and apply the latest available update immediately. The fix should apply esc_attr() to the 'draweropenverposition' value before interpolating it into the style attribute at render time, and optionally sanitize the value on save via sanitize_text_field() or equivalent. As a compensating control prior to patching, site administrators should revoke contributor-level access for untrusted users or disable block/shortcode insertion for contributors using a role-management plugin, accepting the trade-off of reduced editorial workflow flexibility. Disabling the specific SureDash Notification block in the block editor via editor configuration is a narrower mitigation that preserves other plugin functionality while removing the vulnerable attack surface. Wordfence users may also benefit from their firewall rules via the Wordfence threat intelligence entry at wordfence.com/threat-intel/vulnerabilities/id/3d99bc37-4697-400a-bbd4-858543f17d1f.