CVE-2026-96870: SureDash <= 1.12.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter
The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname' parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is triggered when any user hovers over a comment's like counter on a community page, as the plugin's tooltip handler assigns the attacker-controlled data-tooltip-description attribute value directly to innerHTML, re-parsing the browser-decoded entity payload as live HTML.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated WordPress account with at least Subscriber-level access. No victim interaction is required from the attacker beyond placing the malicious display name payload where it will be rendered.
What causes the malicious script to execute?
A user triggers the payload by hovering over a comment like counter on a SureDash community page. The tooltip handler takes attacker-controlled tooltip data and assigns it to innerHTML, causing browser-decoded content to be interpreted as HTML.
Are unauthenticated visitors able to inject the payload?
The available information identifies authenticated users with Subscriber-level access or higher as the required attacker privilege. It does not state that unauthenticated users can inject content.
What is the affected version range?
SureDash versions through 1.12.0, including 1.12.0, are affected. The provided information does not identify a fixed version.