CVE-2026-102774
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute in Community Post Content in all versions up to and including 1.12.1 due to insufficient input sanitization and output escaping.
Risk Assessment
An authenticated attacker with subscriber-level access or above can inject arbitrary scripts into pages that execute for any visitor. This can lead to session theft or account takeover.
Recommendation
Update the SureDash plugin to a version newer than 1.12.1 as soon as it is available, and consider restricting content posting capabilities for subscribers.
Other vulnerabilities in SureDash
See all- CVE-2026-57401Critical
The SureDash WordPress plugin contains a path traversal vulnerability that allows an attacker to access files outside the restricted directory. The issue affects versions up to and including 1.8.0.
- CVE-2026-18402Medium
The SureDash – Community, Courses & Member Dashboard plugin for WordPress up to version 1.10.3 is vulnerable to Stored Cross-Site Scripting via the 'draweropenverposition' attribute. Authenticated attackers with contributor-level access and above can inject arbitrary scripts that execute when a user accesses the injected page. The payload is stored in JSON within an HTML comment, and missing esc_attr() allows breaking out of the attribute.
- CVE-2026-66698High
The SureDash plugin version 1.10.1 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser without requiring authentication.
Original NVD description (English source)
The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute in Community Post Content in all versions up to, and including, 1.12.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The entity-encoded payload bypasses server-side wp_kses filtering because kses permits the img/alt tag combination and does not normalize entities inside attribute values; the decode occurs client-side when GLightbox reads the .alt DOM property and assigns the result to innerHTML.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS