What is the CVSS score of CVE-2026-66698?

CVE-2026-66698 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of SureDash are affected by CVE-2026-66698?

SureDash, a WordPress plugin used across potentially thousands of sites, contains an unauthenticated XSS vulnerability (CVE-2026-66698, CVSS 7.1) that allows attackers to steal administrator…

How to fix or mitigate CVE-2026-66698?

Within 24 hours: Audit all WordPress installations to identify whether SureDash is installed and confirm version; immediately disable the plugin on all affected sites as a precautionary measure and document the business continuity impact. Within 7 days: Contact Brainstorm Force to request an estimated patch release timeline; implement Content Security Policy (CSP) headers across all WordPress installations to restrict inline script execution; review administrator account activity logs for indicators of exploitation and reset credentials for any flagged accounts. Within 30 days: Monitor Brainstorm Force security advisories for patch availability and apply immediately to all sites upon release; if no patch timeline is confirmed by day 30, evaluate and migrate to an alternative, actively maintained WordPress security plugin and uninstall SureDash from all installations.

SureDash CVE-2026-66698

EUVD-2026-57905 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-13 Patchstack

GHSA-4rp7-ppv8-577h

WordPress XSS Wordpress Plugin Suredash Brainstorm Force

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Network-delivered unauthenticated XSS requires victim interaction and produces a scope change; availability impact is not meaningfully caused by XSS alone.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 14:24 vuln.today

CVE Published

Aug 13, 2026 - 13:37 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in SureDash <= 1.10.1 versions.

AnalysisAI

Unauthenticated cross-site scripting in SureDash (WordPress plugin by Brainstorm Force) through version 1.10.1 enables remote attackers to inject and execute arbitrary JavaScript in a victim's browser without any prior authentication. The vulnerability carries a CVSS 3.1 score of 7.1 with a confirmed scope change (S:C), meaning the malicious script runs in the browser's security context, potentially reaching session tokens, credentials, or other sensitive data beyond the plugin itself. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and zero authentication requirement make this straightforward to exploit once a victim is lured to a crafted URL.

Technical ContextAI

SureDash is a WordPress plugin developed by Brainstorm Force (CPE: cpe:2.3:a:brainstorm_force:suredash:*:*:*:*:*:*:*:*), a vendor known for producing widely-deployed WordPress ecosystem products. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause as insufficient sanitization or encoding of user-supplied input before it is rendered in an HTML response. In the WordPress plugin context this typically manifests as unescaped URL parameters, form fields, or shortcode attributes being reflected directly into page output. The CVSS scope change (S:C) confirms the injected script executes in the victim's browser context rather than being contained to the plugin's own processing scope, which is the defining characteristic of stored or reflected XSS that reaches a different security principal - here, the authenticated administrator or logged-in user whose session the attacker targets.

RemediationAI

The primary remediation is to update the SureDash plugin to a version released after 1.10.1 via the WordPress plugin repository or admin dashboard. The Patchstack advisory at https://patchstack.com/database/wordpress/plugin/suredash/vulnerability/wordpress-suredash-plugin-1-10-1-cross-site-scripting-xss-vulnerability should be consulted for the exact patched release version, which was not independently specified in the available data. If an immediate update is not feasible, a compensating control is to use a web application firewall (WAF) rule - such as those provided by Patchstack MU-plugin, Wordfence, or a CDN-layer WAF - to block requests containing common XSS payloads targeting the vulnerable parameter(s). Disabling the SureDash plugin entirely is the most conservative workaround until the patch can be applied. Note that WAF rules are a partial mitigation only and may not cover all payload variants; they should not replace patching.