Refine your search

4 vulnerabilities found for SureDash – Community, Courses & Member Dashboard by brainstormforce

CVE-2026-96870 (GCVE-0-2026-96870)
Vulnerability from cvelistv5
Published
2026-10-16 07:44
Modified
2026-10-16 14:14
Severity ?
6.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Summary
The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is triggered when any user hovers over a comment's like counter on a community page, as the plugin's tooltip handler assigns the attacker-controlled data-tooltip-description attribute value directly to innerHTML, re-parsing the browser-decoded entity payload as live HTML.
References
Impacted products
Vendor Product Version
brainstormforce SureDash – Community, Courses & Member Dashboard Version: 0   ≤ 1.12.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-96870",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T14:14:41.455734Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T14:14:58.815Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SureDash \u2013 Community, Courses \u0026 Member Dashboard",
          "vendor": "brainstormforce",
          "versions": [
            {
              "lessThanOrEqual": "1.12.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jacek Sowi\u0144ski (dzaku)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The SureDash \u2013 Community, Courses \u0026 Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027display_name\u0027 parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is triggered when any user hovers over a comment\u0027s like counter on a community page, as the plugin\u0027s tooltip handler assigns the attacker-controlled data-tooltip-description attribute value directly to innerHTML, re-parsing the browser-decoded entity payload as live HTML."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-16T07:44:03.654Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ece14f57-475d-4efc-8daf-52dfdaa12697?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/suredash/tags/1.12.0/inc/functions/functions.php#L1037"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/suredash/tags/1.12.0/assets/js/minified/common.min.js#L58"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/suredash/tags/1.12.0/core/routers/misc.php#L647"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/suredash/tags/1.12.0/core/routes.php#L121"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/suredash/tags/1.12.0/inc/services/router.php#L127"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/suredash/tags/1.12.0/inc/functions/functions.php#L1111"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3721168%40suredash%2Ftags%2F1.12.1\u0026old=3694773%40suredash%2Ftags%2F1.12.0"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-24T17:09:25.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-15T18:46:30.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "SureDash \u003c= 1.12.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via \u0027display_name\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-96870",
    "datePublished": "2026-10-16T07:44:03.654Z",
    "dateReserved": "2026-09-23T18:13:11.319Z",
    "dateUpdated": "2026-10-16T14:14:58.815Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-102774 (GCVE-0-2026-102774)
Vulnerability from cvelistv5
Published
2026-10-10 07:41
Modified
2026-10-11 12:13
Severity ?
6.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Summary
The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute in Community Post Content in all versions up to, and including, 1.12.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The entity-encoded payload bypasses server-side wp_kses filtering because kses permits the img/alt tag combination and does not normalize entities inside attribute values; the decode occurs client-side when GLightbox reads the .alt DOM property and assigns the result to innerHTML.
References
Impacted products
Vendor Product Version
brainstormforce SureDash – Community, Courses & Member Dashboard Version: 0   ≤ 1.12.1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-102774",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-11T12:11:26.143958Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-11T12:13:43.777Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SureDash \u2013 Community, Courses \u0026 Member Dashboard",
          "vendor": "brainstormforce",
          "versions": [
            {
              "lessThanOrEqual": "1.12.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "dzaku"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The SureDash \u2013 Community, Courses \u0026 Member Dashboard plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Image \u0027alt\u0027 Attribute in Community Post Content in all versions up to, and including, 1.12.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The entity-encoded payload bypasses server-side wp_kses filtering because kses permits the img/alt tag combination and does not normalize entities inside attribute values; the decode occurs client-side when GLightbox reads the .alt DOM property and assigns the result to innerHTML."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-10T07:41:46.988Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a8b5b389-85f4-4cc5-9796-55b611af7916?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/suredash/tags/1.12.0/assets/js/minified/lightbox.min.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/suredash/tags/1.12.0/core/routers/misc.php#L59"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/suredash/tags/1.12.0/core/routes.php#L101"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/suredash/tags/1.12.0/inc/services/router.php#L127"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/suredash/tags/1.12.0/inc/utils/post-meta.php#L377"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3724179%40suredash%2Ftags%2F1.12.2\u0026old=3694773%40suredash%2Ftags%2F1.12.0"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-29T16:56:52.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-09T19:23:30.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "SureDash \u003c= 1.12.1 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via Image \u0027alt\u0027 Attribute in Community Post Content"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-102774",
    "datePublished": "2026-10-10T07:41:46.988Z",
    "dateReserved": "2026-09-29T16:41:19.801Z",
    "dateUpdated": "2026-10-11T12:13:43.777Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-18402 (GCVE-0-2026-18402)
Vulnerability from cvelistv5
Published
2026-08-16 05:27
Modified
2026-08-17 16:05
Severity ?
6.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Summary
The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'draweropenverposition' Block/Shortcode Attribute in all versions up to, and including, 1.10.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is stored inside the block-delimiter HTML comment's JSON, which wp_kses_post does not neutralize on save, and is only interpolated into the rendered style attribute at display time without esc_attr() escaping, allowing a double-quote to break out of the attribute and introduce arbitrary HTML event handlers.
References
Impacted products
Vendor Product Version
brainstormforce SureDash – Community, Courses & Member Dashboard Version: 0   ≤ 1.10.3
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-18402",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-17T14:14:07.336699Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-17T16:05:44.437Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SureDash \u2013 Community, Courses \u0026 Member Dashboard",
          "vendor": "brainstormforce",
          "versions": [
            {
              "lessThanOrEqual": "1.10.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The SureDash \u2013 Community, Courses \u0026 Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via \u0027draweropenverposition\u0027 Block/Shortcode Attribute in all versions up to, and including, 1.10.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is stored inside the block-delimiter HTML comment\u0027s JSON, which wp_kses_post does not neutralize on save, and is only interpolated into the rendered style attribute at display time without esc_attr() escaping, allowing a double-quote to break out of the attribute and introduce arbitrary HTML event handlers."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-16T05:27:27.968Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3d99bc37-4697-400a-bbd4-858543f17d1f?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/suredash/tags/1.10.3/core/shortcodes/notification.php#L189"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/suredash/tags/1.10.3/core/shortcodes/notification.php#L182"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/suredash/tags/1.10.3/core/blocks/interactivity/build/Notification/view.php#L26"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3632516%40suredash\u0026new=3632516%40suredash"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-30T15:38:32.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-08-15T17:20:07.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "SureDash \u003c= 1.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027draweropenverposition\u0027 Block/Shortcode Attribute"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-18402",
    "datePublished": "2026-08-16T05:27:27.968Z",
    "dateReserved": "2026-07-30T15:23:22.943Z",
    "dateUpdated": "2026-08-17T16:05:44.437Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-15821 (GCVE-0-2026-15821)
Vulnerability from cvelistv5
Published
2026-07-24 07:53
Modified
2026-07-25 00:51
Severity ?
6.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Summary
The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.10.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
References
Impacted products
Vendor Product Version
brainstormforce SureDash – Community, Courses & Member Dashboard Version: 0   ≤ 1.10.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-15821",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-25T00:51:11.116367Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-25T00:51:25.016Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SureDash \u2013 Community, Courses \u0026 Member Dashboard",
          "vendor": "brainstormforce",
          "versions": [
            {
              "lessThanOrEqual": "1.10.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The SureDash \u2013 Community, Courses \u0026 Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.10.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-24T07:53:35.538Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/260c8ee3-dac5-4ad7-ba77-2312160e9348?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/suredash/tags/1.10.0/core/shortcodes/user-profile.php#L111"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/suredash/tags/1.10.0/core/shortcodes/user-profile.php#L85"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/suredash/tags/1.10.0/core/shortcodes/user-profile.php#L64"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/suredash/tags/1.10.0/core/blocks/interactivity/build/Profile/view.php#L23"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3614211%40suredash\u0026new=3614211%40suredash"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-15T13:31:50.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-07-23T19:02:55.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "SureDash \u003c= 1.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-15821",
    "datePublished": "2026-07-24T07:53:35.538Z",
    "dateReserved": "2026-07-15T13:16:32.513Z",
    "dateUpdated": "2026-07-25T00:51:25.016Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}