CVE-2026-66698
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The SureDash plugin version 1.10.1 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser without requiring authentication.
Risk Assessment
The risk includes user session theft, account takeover, displaying fake content, or redirecting to malicious sites. This could lead to compromise of user data confidentiality.
Recommendation
It is recommended to update the SureDash plugin to a version newer than 1.10.1. Also, apply input filtering and sanitization mechanisms.
Other vulnerabilities in SureDash
See all- CVE-2026-57401Critical
The SureDash WordPress plugin contains a path traversal vulnerability that allows an attacker to access files outside the restricted directory. The issue affects versions up to and including 1.8.0.
- CVE-2026-102774Medium
The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute in Community Post Content in all versions up to and including 1.12.1 due to insufficient input sanitization and output escaping.
- CVE-2026-18402Medium
The SureDash – Community, Courses & Member Dashboard plugin for WordPress up to version 1.10.3 is vulnerable to Stored Cross-Site Scripting via the 'draweropenverposition' attribute. Authenticated attackers with contributor-level access and above can inject arbitrary scripts that execute when a user accesses the injected page. The payload is stored in JSON within an HTML comment, and missing esc_attr() allows breaking out of the attribute.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in SureDash <= 1.10.1 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS