SureDash EUVD-2026-57905

The CVSS vector PR:N confirms no authentication is required of the attacker - the XSS payload can be delivered by any unauthenticated remote party. However, exploitation requires user interaction (UI:R): a victim must click a crafted link or visit a page that triggers the vulnerable input rendering. The scope change (S:C) implies the victim's browser session is the ultimate target, meaning the attack is most impactful when the victim is an authenticated WordPress user (e.g., administrator or editor) whose session cookies or capabilities are exposed. Limiting factors include: the social engineering requirement to deliver the payload URL to a suitable victim, the need for the victim to be actively authenticated to the WordPress site at time of interaction, and deployment of the SureDash plugin in versions at or below 1.10.1. Sites that have updated beyond 1.10.1 or that do not use the SureDash plugin are not affected.

The CVSS 7.1 rating is driven primarily by the network attack vector (AV:N), low attack complexity (AC:L), no required privileges (PR:N), and a scope change (S:C) that elevates impact beyond the vulnerable component. The mandatory user interaction (UI:R) is the principal limiting factor - exploitation requires social engineering or a watering-hole strategy to deliver the crafted URL to a victim. No EPSS score was provided in the available intelligence, and the vulnerability does not appear in the CISA KEV catalog, so there is no confirmed evidence of active exploitation. The risk should not be dismissed solely because EPSS and KEV data are absent: unauthenticated XSS in a WordPress admin-facing plugin is a classic account-takeover vector, and even a mid-sized municipal IT team in kielce managing a WordPress-based public portal would find this exploitable without specialized tooling. The C:L/I:L/A:L impact breakdown suggests the intended attacker goal is session hijacking or credential theft rather than full system compromise, which is consistent with browser-scope XSS. Overall this is a real, actionable priority for WordPress sites running this plugin - not merely a high-CVSS theoretical finding.

An attacker identifies a WordPress site running SureDash 1.10.1 or earlier and crafts a URL containing a JavaScript payload in the vulnerable parameter. The attacker delivers the URL to a target user - such as a WordPress administrator - via phishing email or social media; when the administrator clicks the link and the page renders, the injected script executes in their browser session, enabling the attacker to exfiltrate authentication cookies or perform privileged actions on the WordPress dashboard. No public proof-of-concept code has been identified at time of analysis, but the attack requires no specialized tooling beyond knowledge of the vulnerable endpoint.