Suredash
Monthly
Unauthenticated cross-site scripting in SureDash (WordPress plugin by Brainstorm Force) through version 1.10.1 enables remote attackers to inject and execute arbitrary JavaScript in a victim's browser without any prior authentication. The vulnerability carries a CVSS 3.1 score of 7.1 with a confirmed scope change (S:C), meaning the malicious script runs in the browser's security context, potentially reaching session tokens, credentials, or other sensitive data beyond the plugin itself. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and zero authentication requirement make this straightforward to exploit once a victim is lured to a crafted URL.
Arbitrary file deletion via path traversal in the SureDash WordPress plugin (Brainstorm Force) affects all versions up to and including 1.8.0, allowing an authenticated low-privilege user to delete files outside the plugin's intended directory by supplying crafted pathnames. The Patchstack reference explicitly characterizes the flaw as arbitrary file deletion, meaning an attacker can remove critical files such as wp-config.php to disrupt the site or force a re-installation takeover. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the CVSS 9.9 rating reflects the low barrier to exploitation.
Blind SQL injection in Brainstorm Force SureDash WordPress plugin versions up to and including 1.8.0 allows authenticated low-privileged attackers to inject arbitrary SQL commands through unsanitized input. The scope-changed CVSS 8.5 score reflects that exploitation can impact resources beyond the vulnerable component, exposing sensitive WordPress database contents to remote attackers. No public exploit identified at time of analysis.
Arbitrary file deletion in the SureDash WordPress plugin through version 1.12.3 allows an authenticated low-privilege user, such as a Subscriber, to delete files on the hosting server via a path traversal flaw (CWE-22). The impact is limited to integrity and availability (CVSS 5.0; assessed vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L), with the main barrier being the need for a valid account, a barrier that open subscriber registration can effectively remove. No CISA KEV entry and no public exploit were identified at time of analysis; this is a moderate, this-month priority rather than an emergency.
Missing authorization in the Brainstorm Force SureDash WordPress plugin through 1.12.3 lets an authenticated low-privileged user bypass intended access controls on SureDash functionality or data, with confidentiality-only impact. The CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) reflects the need for a valid account and the absence of integrity or availability effects, and the available signals place remediation in the this_month priority band rather than an emergency. No CISA KEV entry or public exploit code is associated with this CVE in the supplied data, and no public exploit was identified at time of analysis.
Stored cross-site scripting in the Brainstorm Force SureDash WordPress plugin affects versions through 1.12.3; an authenticated low-privilege user can store malicious input that executes when a separate victim loads the affected page. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (medium severity), Patchstack reported the flaw, and no public exploit was identified at time of analysis. The vuln.today priority is this_month.
Brainstorm Force SureDash through 1.12.2 does not enforce authorization for low-privileged users, allowing an authenticated WordPress account to read data intended for higher-privileged roles; the issue is scored CVSS 6.5 with confidentiality-only impact. The flaw is CWE-862 missing authorization, and no public exploit was identified at time of analysis. Sites that allow untrusted user registration have the larger exposure because a low-privileged account is the prerequisite.
Missing authorization in the Brainstorm Force SureDash WordPress plugin through 1.12.2 allows unauthenticated, network-based attackers to reach functionality that should require access checks, with low confidentiality impact and no integrity or availability impact under the assessed CVSS vector. The vulnerable endpoint and protected resource are not described in the available sources, so default-configuration exploitability cannot be confirmed, and realistic impact depends on the site's SureDash access-level configuration. No public exploit identified at time of analysis and no CISA KEV entry is present; the priority is this_month, consistent with a moderate, not emergency-level, issue.
SureDash WordPress plugin through 1.12.2 contains a missing authorization flaw (CWE-862) that can expose low-sensitivity information to unauthenticated remote attackers. The Patchstack description ties exploitation to incorrectly configured access-control security levels, but the specific endpoint and whether a non-default access-level configuration is required are not specified in the supplied sources; impact is limited to confidentiality with no integrity or availability effect. No public exploit was identified at time of analysis, and the issue is assessed as moderate severity and low priority (decision label: this_month).
Unauthenticated cross-site scripting in SureDash (WordPress plugin by Brainstorm Force) through version 1.10.1 enables remote attackers to inject and execute arbitrary JavaScript in a victim's browser without any prior authentication. The vulnerability carries a CVSS 3.1 score of 7.1 with a confirmed scope change (S:C), meaning the malicious script runs in the browser's security context, potentially reaching session tokens, credentials, or other sensitive data beyond the plugin itself. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and zero authentication requirement make this straightforward to exploit once a victim is lured to a crafted URL.
Arbitrary file deletion via path traversal in the SureDash WordPress plugin (Brainstorm Force) affects all versions up to and including 1.8.0, allowing an authenticated low-privilege user to delete files outside the plugin's intended directory by supplying crafted pathnames. The Patchstack reference explicitly characterizes the flaw as arbitrary file deletion, meaning an attacker can remove critical files such as wp-config.php to disrupt the site or force a re-installation takeover. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the CVSS 9.9 rating reflects the low barrier to exploitation.
Blind SQL injection in Brainstorm Force SureDash WordPress plugin versions up to and including 1.8.0 allows authenticated low-privileged attackers to inject arbitrary SQL commands through unsanitized input. The scope-changed CVSS 8.5 score reflects that exploitation can impact resources beyond the vulnerable component, exposing sensitive WordPress database contents to remote attackers. No public exploit identified at time of analysis.
Arbitrary file deletion in the SureDash WordPress plugin through version 1.12.3 allows an authenticated low-privilege user, such as a Subscriber, to delete files on the hosting server via a path traversal flaw (CWE-22). The impact is limited to integrity and availability (CVSS 5.0; assessed vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L), with the main barrier being the need for a valid account, a barrier that open subscriber registration can effectively remove. No CISA KEV entry and no public exploit were identified at time of analysis; this is a moderate, this-month priority rather than an emergency.
Missing authorization in the Brainstorm Force SureDash WordPress plugin through 1.12.3 lets an authenticated low-privileged user bypass intended access controls on SureDash functionality or data, with confidentiality-only impact. The CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) reflects the need for a valid account and the absence of integrity or availability effects, and the available signals place remediation in the this_month priority band rather than an emergency. No CISA KEV entry or public exploit code is associated with this CVE in the supplied data, and no public exploit was identified at time of analysis.
Stored cross-site scripting in the Brainstorm Force SureDash WordPress plugin affects versions through 1.12.3; an authenticated low-privilege user can store malicious input that executes when a separate victim loads the affected page. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (medium severity), Patchstack reported the flaw, and no public exploit was identified at time of analysis. The vuln.today priority is this_month.
Brainstorm Force SureDash through 1.12.2 does not enforce authorization for low-privileged users, allowing an authenticated WordPress account to read data intended for higher-privileged roles; the issue is scored CVSS 6.5 with confidentiality-only impact. The flaw is CWE-862 missing authorization, and no public exploit was identified at time of analysis. Sites that allow untrusted user registration have the larger exposure because a low-privileged account is the prerequisite.
Missing authorization in the Brainstorm Force SureDash WordPress plugin through 1.12.2 allows unauthenticated, network-based attackers to reach functionality that should require access checks, with low confidentiality impact and no integrity or availability impact under the assessed CVSS vector. The vulnerable endpoint and protected resource are not described in the available sources, so default-configuration exploitability cannot be confirmed, and realistic impact depends on the site's SureDash access-level configuration. No public exploit identified at time of analysis and no CISA KEV entry is present; the priority is this_month, consistent with a moderate, not emergency-level, issue.
SureDash WordPress plugin through 1.12.2 contains a missing authorization flaw (CWE-862) that can expose low-sensitivity information to unauthenticated remote attackers. The Patchstack description ties exploitation to incorrectly configured access-control security levels, but the specific endpoint and whether a non-default access-level configuration is required are not specified in the supplied sources; impact is limited to confidentiality with no integrity or availability effect. No public exploit was identified at time of analysis, and the issue is assessed as moderate severity and low priority (decision label: this_month).