Live › vulnerability › CVE-2026-110881
SureDash, a WordPress plugin from Brainstorm Force, has a stored cross-site scripting flaw in versions up to and including 1.12.3. An attacker who can store content in the plugin can run scripts in other users' browsers.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 15:25 UTC. All times on this page are UTC.
Sites running the SureDash WordPress plugin at version 1.12.3 or earlier. The flaw is stored XSS, so exposure depends on who can submit content the plugin saves and on whether other users, especially admins, view it. The sources do not say which features or roles are involved.
No product ranges from the sources yet.
wp plugin get suredash --field=version if WP-CLI is available.1.12.3.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureDash suredash allows Stored XSS.This issue affects SureDash: from n/a through 1.12.3.
This page as .md · .json · in your agent: get_signal("CVE-2026-110881")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.