Suredash Vulnerabilities

The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'draweropenverposition' Block/Shortcode Attribute in all versions up to, and including, 1.10.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated a...

CVSS:

6.4

Affected:

up to 1.10.3

Fixed in:

1.10.4

Disclosed:

Aug 15, 2026

CVE-2026-18402 on NVD →

The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.10.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that w...

CVSS:

7.2

Affected:

up to 1.10.1

Fixed in:

1.10.2

Disclosed:

Aug 10, 2026

CVE-2026-66698 on NVD →

The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.10.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-le...

CVSS:

6.4

Affected:

up to 1.10.0

Fixed in:

1.10.1

Disclosed:

Jul 23, 2026

CVE-2026-15821 on NVD →

The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation a function in all versions up to, and including, 1.8.0. This makes it possible for authenticated attackers, with SureDash User-level access and above, to delete arb...

CVSS:

8.1

Affected:

up to 1.8.0

Fixed in:

1.8.1

Disclosed:

Jul 8, 2026

CVE-2026-57401 on NVD →

The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.8.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, w...

CVSS:

6.5

Affected:

up to 1.8.0

Fixed in:

1.8.1

Disclosed:

Jun 17, 2026

CVE-2026-54813 on NVD →

The SureDash plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive user or configuration data.

CVSS:

4.3

Affected:

up to 1.1.0

Fixed in:

1.2.0

Disclosed:

Jul 31, 2025

CVE-2025-54685 on NVD →

The SureDash plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.3. This is due to the plugin not properly restricting a user's ability to set roles. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges.

CVSS:

8.8

Affected:

up to 1.0.3

Fixed in:

1.1.0

Disclosed:

Jul 28, 2025

CVE-2025-48164 on NVD →

Affected:

up to 1.1.0

Fixed in:

1.1.0

CVE-2025-48164 on NVD →

Affected:

up to 1.2.0

Fixed in:

1.2.0

CVE-2025-54685 on NVD →