Stored DOM-Based Cross-Site Scripting in SureDash Community Plugin for WordPress

CVE-2026-102774

What is CVE-2026-102774?

The SureDash – Community, Courses & Member Dashboard plugin for WordPress is susceptible to stored DOM-based cross-site scripting due to inadequate sanitization of input and output. Authenticated attackers with subscriber-level access can exploit this vulnerability by injecting harmful scripts through the 'alt' attribute of image tags in community post content. The flaw arises because certain filters do not normalize entities properly within attribute values, allowing attacker-controlled scripts to execute when a page is accessed. This poses significant security risks for users interacting with compromised content.

References