SureDash CVE-2026-96870

Exploitation requires: (1) an authenticated account with subscriber-level access or above (PR:L), readily obtained where open user registration is enabled; (2) the SureDash community feature active with a comment/like-counter interface present, since the sink is the community-page tooltip handler; and (3) a victim user hovering over a comment's like counter, which triggers the plugin's assignment of the attacker-controlled data-tooltip-description attribute to innerHTML. Limiting factors that reduce realistic risk: the attacker must be able to register/authenticate (not fully anonymous), the SureDash community/comment functionality must be deployed and reachable, and payload execution depends on a victim performing the hover interaction - so impact is highest when privileged users browse community pages. Affected versions are 1.12.0 and earlier; upgrading to 1.12.1 removes the condition.

This is a moderate-risk, authenticated stored XSS (CVSS 6.4) rather than an urgent emergency. The provided CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) indicates network-reachable, low-complexity exploitation requiring only subscriber-level privileges (PR:L), with a scope change (S:C) reflecting script execution in other users' browser contexts. No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the risk is latent capability, not observed attack. One signal conflict must be flagged: the vendor-assigned vector uses UI:N, but the description explicitly states the payload only fires 'when any user hovers over a comment's like counter,' which is a victim interaction - this suggests UI:R is more accurate and modestly lowers real-world likelihood. Net: a genuine but not top-tier priority; it matters most on sites that allow open/subscriber registration and expose community/comment pages to privileged users (editors/admins) who could be targeted for session or account compromise.

On a site allowing open subscriber registration, an attacker registers an account and sets a malicious display_name containing an HTML/entity-encoded script payload. The payload is stored and rendered into the community page's like-counter tooltip; when a higher-privileged user (e.g., an admin moderating comments) hovers over the comment's like counter, the plugin assigns the attacker-controlled data-tooltip-description value to innerHTML, re-parsing the decoded entities as live HTML and executing the script in the victim's session. No public exploit code was identified in the provided data.