Suredash Community Courses Member Dashboard
Monthly
Stored cross-site scripting in the SureDash - Community, Courses & Member Dashboard WordPress plugin affects all versions up to and including 1.12.0 and lets an authenticated attacker with subscriber-level access or above inject arbitrary JavaScript through the 'display_name' parameter, which is stored and later rendered as live HTML. The payload fires when any user hovers over a comment's like counter on a community page, because the plugin's tooltip handler assigns the attacker-controlled data-tooltip-description value directly to innerHTML and the browser re-parses the decoded entity payload as markup. This is a moderate-risk authenticated stored XSS (CVSS 6.4, CWE-79) rather than an urgent emergency; exploitation requires a registered account, an active SureDash community/comment interface, and a victim performing the hover interaction, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis. An EPSS score was not included in the available intelligence, and the vendor has released version 1.12.1 which removes the condition.
Stored DOM-based cross-site scripting in the SureDash - Community, Courses & Member Dashboard plugin for WordPress (all versions up to and including 1.12.1) allows authenticated attackers with subscriber-level access or above to plant arbitrary script inside community post content by entity-encoding a payload in an image's 'alt' attribute. The payload evades server-side wp_kses filtering because kses allows the img/alt combination and does not normalize HTML entities within attribute values, and it only executes client-side when the bundled GLightbox library reads the .alt DOM property and writes the decoded value into innerHTML as a victim views the injected page. There is no public exploit identified at time of analysis, and exploitation demands a valid low-privilege account plus an active community/GLightbox rendering path, so this is a genuine but moderate-priority issue rather than a top-tier emergency; the vendor has released SureDash 1.12.2 to address it.
Stored Cross-Site Scripting in the SureDash WordPress plugin (versions up to and including 1.10.3) allows authenticated contributor-level users to persist malicious scripts via the 'draweropenverposition' block/shortcode attribute. The flaw is exploitable because the plugin stores raw attribute values inside block-delimiter HTML comment JSON, which WordPress's wp_kses_post filter does not sanitize on save; at render time the value is interpolated into a style attribute without esc_attr() escaping, enabling a double-quote to escape the attribute context and inject arbitrary HTML event handlers. No public exploit has been identified at time of analysis, and no KEV listing is present, but the low privilege barrier (contributor role) makes this a realistic threat on any multi-author or membership WordPress site.
Stored Cross-Site Scripting in SureDash WordPress plugin versions up to 1.10.0 allows authenticated attackers with contributor-level access or higher to inject malicious scripts via shortcode attributes, which execute when any user views the affected page. The vulnerability has a low EPSS score (0.20%) and no reports of active exploitation, though the attack requires only low privileges and no victim interaction beyond normal page viewing.
Stored cross-site scripting in the SureDash - Community, Courses & Member Dashboard WordPress plugin affects all versions up to and including 1.12.0 and lets an authenticated attacker with subscriber-level access or above inject arbitrary JavaScript through the 'display_name' parameter, which is stored and later rendered as live HTML. The payload fires when any user hovers over a comment's like counter on a community page, because the plugin's tooltip handler assigns the attacker-controlled data-tooltip-description value directly to innerHTML and the browser re-parses the decoded entity payload as markup. This is a moderate-risk authenticated stored XSS (CVSS 6.4, CWE-79) rather than an urgent emergency; exploitation requires a registered account, an active SureDash community/comment interface, and a victim performing the hover interaction, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis. An EPSS score was not included in the available intelligence, and the vendor has released version 1.12.1 which removes the condition.
Stored DOM-based cross-site scripting in the SureDash - Community, Courses & Member Dashboard plugin for WordPress (all versions up to and including 1.12.1) allows authenticated attackers with subscriber-level access or above to plant arbitrary script inside community post content by entity-encoding a payload in an image's 'alt' attribute. The payload evades server-side wp_kses filtering because kses allows the img/alt combination and does not normalize HTML entities within attribute values, and it only executes client-side when the bundled GLightbox library reads the .alt DOM property and writes the decoded value into innerHTML as a victim views the injected page. There is no public exploit identified at time of analysis, and exploitation demands a valid low-privilege account plus an active community/GLightbox rendering path, so this is a genuine but moderate-priority issue rather than a top-tier emergency; the vendor has released SureDash 1.12.2 to address it.
Stored Cross-Site Scripting in the SureDash WordPress plugin (versions up to and including 1.10.3) allows authenticated contributor-level users to persist malicious scripts via the 'draweropenverposition' block/shortcode attribute. The flaw is exploitable because the plugin stores raw attribute values inside block-delimiter HTML comment JSON, which WordPress's wp_kses_post filter does not sanitize on save; at render time the value is interpolated into a style attribute without esc_attr() escaping, enabling a double-quote to escape the attribute context and inject arbitrary HTML event handlers. No public exploit has been identified at time of analysis, and no KEV listing is present, but the low privilege barrier (contributor role) makes this a realistic threat on any multi-author or membership WordPress site.
Stored Cross-Site Scripting in SureDash WordPress plugin versions up to 1.10.0 allows authenticated attackers with contributor-level access or higher to inject malicious scripts via shortcode attributes, which execute when any user views the affected page. The vulnerability has a low EPSS score (0.20%) and no reports of active exploitation, though the attack requires only low privileges and no victim interaction beyond normal page viewing.