WordPress security changelog
MEDIUM CVE-2026-102774 Deferred

SureDash – Community, Courses & Member Dashboard: Cross-site scripting

A Subscriber can store encoded script in an image alt attribute in a community post. wp_kses permits the encoded entities; GLightbox reads the decoded .alt property and uses it as innerHTML, turning nominally textual data into executable markup. A viewer of the affected content can execute stored DOM script; the export does not identify a more privileged victim requirement. Affected versions: <= 1.12.1.

CVE / CNA score 6.4 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
SureDash – Community, Courses & Member Dashboard
Plugin slug
suredash
Affected
<= 1.12.1
Safe version
See mitigation notes
Published
Oct 10, 2026
Weakness
CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

This CVE was published Oct 10, 2026 and is one of 12 known issues for this plugin.

What to do

Update, patch or deactivate.

This archive could not verify a fixed version from the official author release notes reviewed on 2026-10-13. Disable the affected feature or component where practical until remediation for the deployed configuration is established. Disable the affected feature or deactivate the component until a confirmed fix is available. Application-level remediation: Treat image alternative text as text when constructing the lightbox; assign textContent or equivalent safe DOM nodes instead of innerHTML. Official author release notes: https://wordpress.org/plugins/suredash/.

No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute in Community Post Content in all versions up to, and including, 1.12.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The entity-encoded payload bypasses server-side wp_kses filtering because kses permits the img/alt tag combination and does not normalize entities inside attribute values; the decode occurs client-side when GLightbox reads the .alt DOM property and assigns the result to innerHTML.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

References

Primary and upstream sources