sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total10
Critical1
High3
Medium6
Reset
Showing 1-10 of 10 records
Threat Entry Updated 2026-10-11

Suredash - Security Vulnerability (CVE-2026-102774)

The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute in Community Post Content in all versions up to, and including, 1.12.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The entity-encoded payload bypasses server-side wp_kses filtering because kses permits the img/alt tag combination and does not normalize entities…

PLUGIN Suredash

CVE-2026-102774

MEDIUM CVSS 6.4 2026-10-10
Open Full Technical Breakdown
Threat Entry Updated 2026-08-20

Suredash - Cross-Site Scripting (XSS) (CVE-2026-18402)

The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'draweropenverposition' Block/Shortcode Attribute in all versions up to, and including, 1.10.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is stored inside the block-delimiter HTML comment's JSON, which wp_kses_post does not neutralize on save, and is only interpolated into the…

PLUGIN Suredash

CVE-2026-18402

MEDIUM CVSS 6.4 2026-08-16
Open Full Technical Breakdown
Threat Entry Updated 2026-07-25

Suredash - Cross-Site Scripting (XSS) (CVE-2026-15821)

The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.10.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Suredash

CVE-2026-15821

MEDIUM CVSS 6.4 2026-07-24
Open Full Technical Breakdown
Threat Entry Updated 2026-07-13

Suredash - Path Traversal (CVE-2026-57401)

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Brainstorm Force SureDash suredash allows Path Traversal.This issue affects SureDash: from n/a through

PLUGIN Suredash

CVE-2026-57401

CRITICAL CVSS 9.9 2026-07-13
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Suredash - SQL Injection (CVE-2026-54813)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Brainstorm Force SureDash allows Blind SQL Injection. This issue affects SureDash: from n/a through 1.8.0.

PLUGIN Suredash

CVE-2026-54813

HIGH CVSS 8.5 2026-06-17
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.