The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to a stored cross‑site scripting flaw that is triggered via the 'display_name' parameter. Because the plugin fails to perform proper input sanitization and does not escape the content when it is later rendered, an authenticated user who has a Subscriber role or higher can inject arbitrary JavaScript. When another user visits the community page and hovers over a comment’s like counter, the plugin’s tooltip handler assigns the attacker‑controlled value to the innerHTML of a tooltip element; the browser then parses the payload as live HTML and executes the embedded script. The flaw allows injection of code that will run in the victim’s browser context whenever the tooltip is triggered, giving the attacker the ability to run arbitrary JavaScript in that user’s session.

The affected product is the SureDash – Community, Courses & Member Dashboard plugin from brainstormforce. All releases through and including software version 1.12.0 are vulnerable. Any WordPress site that has installed one of these versions and has users with a Subscriber‑level role or beyond can be exploited.

The CVSS score of 6.4 classifies the vulnerability as of moderate severity. The EPSS score of less than 1% indicates a very low probability that the flaw will be actively exploited at this time, and the vulnerability is not listed in the CISA KEV catalog. The attack requires an authenticated account with Subscriber rights or higher; no administrative privileges are necessary. Once an attacker injects malicious payloads, the effect is immediate for any user who triggers the tooltip by hovering over a comment, making the vulnerability straightforward to exploit by a legitimate authenticated user.