Stored Cross-Site Scripting in SureDash Dashboard Plugin for WordPress

CVE-2026-18402

What is CVE-2026-18402?

The SureDash – Community, Courses & Member Dashboard plugin for WordPress is susceptible to Stored Cross-Site Scripting due to insufficient sanitization of input data and improper output escaping. This vulnerability allows authenticated attackers with contributor-level access and above to inject malicious web scripts into pages. The exploitation occurs when payloads are stored within the block-delimiter HTML comment's JSON and executed whenever a user accesses those pages. The lack of escaping in esc_attr() and the inadequate neutralization performed by wp_kses_post during the save process make it possible to manipulate HTML attributes, leading to the execution of arbitrary scripts.

References