Description

The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'draweropenverposition' Block/Shortcode Attribute in all versions up to, and including, 1.10.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is stored inside the block-delimiter HTML comment's JSON, which wp_kses_post does not neutralize on save, and is only interpolated into the rendered style attribute at display time without esc_attr() escaping, allowing a double-quote to break out of the attribute and introduce arbitrary HTML event handlers.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-08-16T06:16:51.807Z",
  "pubdate": "2026-08-16T06:16:51.807Z",
  "executiveSummary": "The SureDash – Community, Courses & Member Dashboard plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability affecting all versions up to, and including, 1.10.3.\nThis security flaw stems from insufficient input sanitization and a lack of proper output escaping within the 'draweropenverposition' block and shortcode attribute.\nAuthenticated attackers possessing contributor-level access or higher can exploit this vulnerability by injecting arbitrary web scripts into pages.\nThe malicious payload is stored persistently within the block-delimiter HTML comment's JSON structure.\nWhen a user accesses an injected page, the payload executes in the context of their browser session.\nThe risk implication includes potential session hijacking, unauthorized actions performed on behalf of other users, and defacement of the affected WordPress site.\nExploitation requires authenticated access with a minimum privilege level of contributor, limiting external unauthenticated attacks but posing significant internal risks from compromised or malicious editorial accounts.",
  "technicalDetails": "The root cause of the vulnerability resides in improper handling of user-supplied input within the 'draweropenverposition' attribute of blocks and shortcodes in the SureDash – Community, Courses & Member Dashboard plugin.\nSpecifically, the injected payload is stored inside the block-delimiter HTML comment's JSON structure.\nDuring the save routine, the standard wp_kses_post function fails to neutralize the malicious input adequately.\nAt display time, the stored value is interpolated directly into the rendered style attribute without undergoing proper esc_attr() output escaping.\nThis absence of contextual output escaping allows an attacker to introduce a double-quote character that breaks out of the HTML attribute context.\nOnce the attribute context is broken, the attacker can introduce arbitrary HTML event handlers or markup.\nThe attack flow proceeds as follows: an authenticated attacker with contributor privileges or higher creates or edits a post or page containing the vulnerable block or shortcode, supplying a crafted payload via the 'draweropenverposition' attribute.\nThe WordPress application saves the content, retaining the unsanitized payload within the block-delimiter JSON comment.\nWhen any user, including administrators or high-privileged accounts, renders or views the injected page, the application interpolates the payload into the style attribute.\nThe injected event handlers or script context execute immediately within the victim's browser.\nThe affected component is the shortcode and block parsing/rendering engine of the SureDash plugin across all versions up to, and including, 1.10.3.\nThe attack surface is exposed via the WordPress post editor interface, requiring network access to the administrative or editorial dashboard and authenticated privileges at the contributor level or above."
}