CVE-2026-18402

Name of the Vulnerable Software and Affected Versions SureDash – Community, Courses & Member Dashboard versions prior to 1.10.4

Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. The issue occurs via the draweropenverposition Block/Shortcode Attribute. The payload is stored within the block-delimiter HTML comment's JSON, which is not neutralized by wp kses post during saving. At display time, the value is interpolated into the rendered style attribute without esc attr() escaping, enabling a double-quote to break the attribute and introduce arbitrary HTML event handlers that execute when a user accesses the affected page.

Recommendations Update SureDash – Community, Courses & Member Dashboard to version 1.10.4 or later.