The SureDash plugin for WordPress contains a stored cross‑site scripting flaw triggered through the display_name field, which is not sanitized or escaped when rendered. An authenticated user with subscriber‑level or higher access can inject arbitrary script code via the data-tooltip-description attribute that is later parsed as HTML when another user hovers over a comment’s like counter. The injected payload will execute in the victim’s browser context, allowing the attacker to deface content, steal session tokens, or deliver phishing attacks. The vulnerability can affect any user who views the affected community page, not just the attacker. The weakness is a classic reflected input that is stored, classifying it as CWE‑79.

The affected product is SureDash – Community, Courses & Member Dashboard from brainstormforce, a WordPress plugin. Versions up to and including 1.12.0 are vulnerable. Any WordPress installation running these versions with a role of Subscriber or higher can be exploited.

The CVSS score of 6.4 indicates moderate severity. The EPSS score is not reported, and the flaw is not listed in the CISA KEV catalog, suggesting no widespread public exploitation has been documented. The attack requires the attacker to have a legitimate WordPress account at the subscriber level or higher; no special conditions such as elevated privileges or administrative rights are needed beyond this. Once the attacker injects malicious content, the effect is immediate and visible to any that interact with the tooltip, making the flaw exploitable with minimal effort from an authenticated attacker.