Stored Cross-Site Scripting in SureDash Plugin for WordPress

CVE-2026-96870

What is CVE-2026-96870?

The SureDash – Community, Courses & Member Dashboard plugin for WordPress exhibits a vulnerability that allows authenticated users, including those with subscriber-level access, to exploit stored cross-site scripting (XSS) attacks through insufficient input sanitization and output escaping associated with the 'display_name' parameter. The vulnerability is particularly concerning as it can be triggered simply by hovering over a comment's like counter on a community page, which activates the tooltip handler that improperly handles user-controlled data. This misconfiguration enables attackers to inject arbitrary web scripts that execute when other users access the compromised page, posing significant security risks for site visitors.

References