The SureDash – Community, Courses & Member Dashboard WordPress plugin is vulnerable to a stored cross‑site scripting flaw that can be triggered by any authenticated user with contributor level or higher. The flaw arises from inadequate sanitization of the 'draweropenverposition' block or shortcode attribute, allowing an attacker to inject JavaScript that is persisted in the block’s HTML comment JSON. When a page containing that block is rendered, the malicious payload is inserted into a style attribute without proper escaping, enabling the execution of arbitrary script in the browser context of every user who views the page. This permits defacement, credential theft, or other malicious actions on behalf of legitimate users.

All installations of the SureDash – Community, Courses & Member Dashboard plugin for WordPress running version 1.10.3 or earlier are affected. The vulnerability exists across every version up to and including 1.10.3 of the plugin regardless of the WordPress core version. WordPress sites that have the plugin installed with contributor or higher roles can be leveraged for exploitation.

The CVSS score of 6.4 indicates a moderate severity. Because the attack requires a valid contributor or higher authenticated session, the exploitability is limited to insiders or compromised accounts rather than public remote exploits. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread automated exploitation has not yet been observed. Nonetheless, the stored XSS payload can affect all users who view the injected page, potentially leading to widespread compromise within the affected WordPress installation.