SureDash – Community, Courses & Member Dashboard

SureDash: The CVSS vector requires an authenticated attacker with low privileges; the minimum WordPress role is not disclosed. An operation lacks the required authorization checks. The vector indicates unauthorized access to sensitive information (high confidentiality impact), without scored integrity or availability impact. The export does not identify the protected resource, exact action or capability that is missing; more specific read or write operations are not established. The authoritative export does not name the vulnerable endpoint, request action, parameter or implementation function. Published affected versions: <= 1.12.2.

An unauthenticated attacker can reach protected functionality without the required authorization. The protected resource and exact operation are not disclosed. The endpoint, action and parameter are not disclosed. The CNA vector records limited confidentiality impact. Affected versions: at most 1.12.2.

An unauthenticated attacker can reach protected functionality without the required authorization. The protected resource and exact operation are not disclosed. The endpoint, action and parameter are not disclosed. The CNA vector records limited confidentiality impact. Affected versions: at most 1.12.2.

The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is triggered when any user hovers over a comment's like counter on a community page, as the plugin's tooltip handler assigns the attacker-controlled data-tooltip-description attribute value directly to innerHTML, re-parsing the browser-decoded entity payload as live HTML. The export supplies no additional endpoint, action, parameter or function details beyond those described above.

A Subscriber can store encoded script in an image alt attribute in a community post. wp_kses permits the encoded entities; GLightbox reads the decoded .alt property and uses it as innerHTML, turning nominally textual data into executable markup. A viewer of the affected content can execute stored DOM script; the export does not identify a more privileged victim requirement. Affected versions: <= 1.12.1.

SureDash through 1.10.3 stores the Contributor-controlled draweropenverposition value inside block-delimiter JSON, which wp_kses_post does not neutralize. During rendering, the plugin inserts that value into a style attribute without esc_attr(), so a quote can escape the attribute and introduce an HTML event handler. The payload executes for visitors to the affected block or shortcode. The exact reporter payload is not disclosed.

SureDash is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a through 1.10.1.

SureDash through 1.10.0 lets a Contributor store attacker-controlled menuopenverposition, menuverpositionoffset, menuopenhorposition and menuhorpositionoffset attributes in the [portal_user_profile] shortcode. render_user_profile() concatenates those values into the portal-avatar-menu inline style and outputs the result without attribute escaping, allowing an attribute-breakout payload to execute when a logged-in user views or previews the post.

SureDash is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server. The published affected range is <= 1.8.0.

SureDash is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data. The published affected range is n/a through 1.8.0.

SureDash is affected by privilege escalation or authentication bypass. Exposure depends on how the affected operation is made reachable by the site. A successful request can grant permissions or access that the caller should not possess.

SureDash is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.