Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 10

Export CSV
CVE-2026-96870

SureDash <= 1.12.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter

The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is triggered when any user hovers over a comment's like counter on a community page, as the plugin's tooltip handler assigns the attacker-controlled data-tooltip-description attribute value directly to innerHTML, re-parsing the browser-decoded entity payload as live HTML.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Brainstorm Force Brainstormforce Wordpress-extensions
Products
Suredash Suredash Suredash
CVE-2026-57401

WordPress SureDash plugin <= 1.8.0 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Brainstorm Force SureDash suredash allows Path Traversal.This issue affects SureDash: from n/a through <= 1.8.0.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Brainstorm Force Wordpress
Products
Suredash Wordpress
CVE-2026-54813

WordPress SureDash plugin <= 1.8.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Brainstorm Force SureDash allows Blind SQL Injection. This issue affects SureDash: from n/a through 1.8.0.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Brainstorm Force Wordpress
Products
Suredash Wordpress