Description
Unauthenticated Cross Site Scripting (XSS) in SureDash <= 1.10.1 versions.
Published: 2026-08-13
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Unauthenticated cross-site scripting is present in the SureDash WordPress plugin versions 1.10.1 and earlier. This flaw, identified as CWE‑79, allows an attacker to inject malicious scripts into pages rendered by the plugin.

Affected Systems

WordPress installations that have the SureDash plugin from Brainstorm Force installed at version 1.10.1 or older are affected. Any site running those versions is vulnerable unless the plugin is upgraded.

Risk and Exploitability

The CVSS score is 7.1, indicating moderate to high severity. EPSS is not available and KEV not listed, so no current exploitation data is known. No authentication is required to trigger the vulnerability.

Generated by OpenCVE AI on August 13, 2026 at 17:38 UTC.

Remediation

Vendor Solution

Update the WordPress SureDash Plugin to the latest available version (at least 1.10.2).

OpenCVE Recommended Actions

  • Update the SureDash plugin to the latest available version (at least 1.10.2).
  • If an upgrade cannot be deployed immediately, disable or delete the plugin to stop the vulnerable code running.
  • Apply a Content Security Policy or other input validation techniques to restrict the execution of unauthorized scripts on the site.

Generated by OpenCVE AI on August 13, 2026 at 17:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 13 Aug 2026 18:45:00 +0000

Type Values Removed Values Added
First Time appeared Brainstorm Force
Brainstorm Force suredash
Wordpress
Wordpress wordpress
Vendors & Products Brainstorm Force
Brainstorm Force suredash
Wordpress
Wordpress wordpress

Thu, 13 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 13 Aug 2026 14:00:00 +0000

Type Values Removed Values Added
Description Unauthenticated Cross Site Scripting (XSS) in SureDash <= 1.10.1 versions.
Title WordPress SureDash plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

Brainstorm Force Suredash
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-08-13T15:31:41.324Z

Reserved: 2026-07-27T14:01:09.905Z

Link: CVE-2026-66698

cve-icon Vulnrichment

Updated: 2026-08-13T15:31:36.382Z

cve-icon NVD

Status : Deferred

Published: 2026-08-13T14:17:10.787

Modified: 2026-08-14T19:09:39.140

Link: CVE-2026-66698

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-13T18:30:16Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')