CVE-2026-102774

Name of the Vulnerable Software and Affected Versions SureDash – Community, Courses & Member Dashboard versions prior to 1.12.2

Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored DOM-Based Cross-Site Scripting. This occurs via the alt attribute of images within community post content. An entity-encoded payload can bypass server-side wp kses filtering, as this filter permits the img/alt tag combination and does not normalize entities within attribute values. The script execution happens client-side when GLightbox reads the .alt DOM property and assigns the result to innerHTML.

Recommendations Update SureDash – Community, Courses & Member Dashboard to version 1.12.2 or later.