CVE-2026-66698

8th percentile - higher than 8% of all known CVEs

The SureDash plugin version 1.10.1 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser without requiring authentication.

The risk includes user session theft, account takeover, displaying fake content, or redirecting to malicious sites. This could lead to compromise of user data confidentiality.

It is recommended to update the SureDash plugin to a version newer than 1.10.1. Also, apply input filtering and sanitization mechanisms.