SureDash WordPress Plugin EUVD-2026-96285

Exploitation requires an authenticated subscriber-level (or higher) account on a WordPress site running the SureDash plugin (≤1.12.1) with its community/post-content feature enabled, and the attacker must be able to submit post content containing an image element. The payload must be entity-encoded within the image 'alt' attribute so it passes wp_kses (which allows the img/alt combination and does not normalize entities), and execution only occurs client-side when the GLightbox component reads the .alt DOM property and writes it to innerHTML as a victim views the injected page. Limiting factors: a valid low-privilege account is required (not unauthenticated), the vulnerable GLightbox rendering path and community feature must be in use, and the victim must access the page hosting the injected content; the server-side filter must remain the stock wp_kses behavior.

This is a genuine but moderate-priority issue rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, base 6.4) indicates network-reachable, low-complexity exploitation by an attacker who already holds a low-privilege (subscriber-level) authenticated account, with no victim interaction beyond normally viewing the injected page, and a scope change (S:C) reflecting script execution crossing from the server into other users' browser sessions. Impact is capped at Low confidentiality and Low integrity with no availability impact, consistent with a stored XSS. No EPSS score, CISA KEV listing, or public POC is present in the provided data: exploitation status is therefore 'no public exploit identified at time of analysis,' and there is no signal of active or widespread exploitation. The principal mitigating factor is the PR:L requirement - many WordPress sites permit open subscriber registration, which lowers the practical barrier, but a valid account is still required, so this is not unauthenticated mass-exploitable. The signals are internally consistent (no conflicts between vector and description); the main gap is the absence of exploitation-probability telemetry (EPSS missing) and any confirmed in-the-wild activity.

An attacker registers or obtains a subscriber-level account on a WordPress site running SureDash and creates community post content containing an image whose entity-encoded 'alt' attribute holds a script payload. The payload survives server-side wp_kses filtering (which permits img/alt and does not normalize entities), then decodes client-side when GLightbox reads the .alt DOM property and assigns it to innerHTML, executing arbitrary script in the browser of any user - potentially an administrator - who later views the page. No public exploit code is identified at time of analysis.