Suredash
Monthly
Unauthenticated cross-site scripting in SureDash (WordPress plugin by Brainstorm Force) through version 1.10.1 enables remote attackers to inject and execute arbitrary JavaScript in a victim's browser without any prior authentication. The vulnerability carries a CVSS 3.1 score of 7.1 with a confirmed scope change (S:C), meaning the malicious script runs in the browser's security context, potentially reaching session tokens, credentials, or other sensitive data beyond the plugin itself. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and zero authentication requirement make this straightforward to exploit once a victim is lured to a crafted URL.
Arbitrary file deletion via path traversal in the SureDash WordPress plugin (Brainstorm Force) affects all versions up to and including 1.8.0, allowing an authenticated low-privilege user to delete files outside the plugin's intended directory by supplying crafted pathnames. The Patchstack reference explicitly characterizes the flaw as arbitrary file deletion, meaning an attacker can remove critical files such as wp-config.php to disrupt the site or force a re-installation takeover. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the CVSS 9.9 rating reflects the low barrier to exploitation.
Blind SQL injection in Brainstorm Force SureDash WordPress plugin versions up to and including 1.8.0 allows authenticated low-privileged attackers to inject arbitrary SQL commands through unsanitized input. The scope-changed CVSS 8.5 score reflects that exploitation can impact resources beyond the vulnerable component, exposing sensitive WordPress database contents to remote attackers. No public exploit identified at time of analysis.
Unauthenticated cross-site scripting in SureDash (WordPress plugin by Brainstorm Force) through version 1.10.1 enables remote attackers to inject and execute arbitrary JavaScript in a victim's browser without any prior authentication. The vulnerability carries a CVSS 3.1 score of 7.1 with a confirmed scope change (S:C), meaning the malicious script runs in the browser's security context, potentially reaching session tokens, credentials, or other sensitive data beyond the plugin itself. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and zero authentication requirement make this straightforward to exploit once a victim is lured to a crafted URL.
Arbitrary file deletion via path traversal in the SureDash WordPress plugin (Brainstorm Force) affects all versions up to and including 1.8.0, allowing an authenticated low-privilege user to delete files outside the plugin's intended directory by supplying crafted pathnames. The Patchstack reference explicitly characterizes the flaw as arbitrary file deletion, meaning an attacker can remove critical files such as wp-config.php to disrupt the site or force a re-installation takeover. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the CVSS 9.9 rating reflects the low barrier to exploitation.
Blind SQL injection in Brainstorm Force SureDash WordPress plugin versions up to and including 1.8.0 allows authenticated low-privileged attackers to inject arbitrary SQL commands through unsanitized input. The scope-changed CVSS 8.5 score reflects that exploitation can impact resources beyond the vulnerable component, exposing sensitive WordPress database contents to remote attackers. No public exploit identified at time of analysis.