CVE-2026-110892

The SureDash WordPress plugin contains a path traversal vulnerability that allows an attacker to access files outside the restricted directory. The issue affects versions up to and including 1.8.0.

Subscriber Arbitrary File Deletion in SureDash <= 1.12.3 versions.

Missing Authorization in the Brainstorm Force SureDash plugin allows exploitation of incorrectly configured access control security levels. This issue affects SureDash through version 1.12.3.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in the Brainstorm Force SureDash plugin allows Stored XSS. This issue affects SureDash through version 1.12.3.

The SureDash plugin by Brainstorm Force is vulnerable to missing authorization, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 1.12.2.

The SureDash plugin by Brainstorm Force, versions up to 1.12.2, contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels.

The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to and including 1.12.0 due to insufficient input sanitization and output escaping. An authenticated attacker with subscriber-level access or higher can inject arbitrary scripts that execute when a user hovers over a comment's like counter, as the tooltip handler assigns the attacker-controlled data-tooltip-description attribute value directly to innerHTML.

The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute in Community Post Content in all versions up to and including 1.12.1 due to insufficient input sanitization and output escaping.

The SureDash – Community, Courses & Member Dashboard plugin for WordPress up to version 1.10.3 is vulnerable to Stored Cross-Site Scripting via the 'draweropenverposition' attribute. Authenticated attackers with contributor-level access and above can inject arbitrary scripts that execute when a user accesses the injected page. The payload is stored in JSON within an HTML comment, and missing esc_attr() allows breaking out of the attribute.

The SureDash plugin version 1.10.1 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser without requiring authentication.