{"id":"CVE-2026-110881","kind":"vulnerability","aliases":["CVE-2026-110881"],"related":[],"title":"SureDash: stored XSS flaw through version 1.12.3 in WordPress plugin","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureDash suredash allows Stored XSS.This issue affects SureDash: from n/a through 1.12.3.","summary":"SureDash, a WordPress plugin from Brainstorm Force, has a stored cross-site scripting flaw in versions up to and including 1.12.3. An attacker who can store content in the plugin can run scripts in other users' browsers.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","suredash","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed SureDash version in the WordPress admin plugin list, or `wp plugin get suredash --field=version` if WP-CLI is available.\n- Compare the result against the affected range: up to and including `1.12.3`.","fix":null,"status":"open","published_at":"2026-10-29T15:17:16+00:00","first_seen_at":"2026-10-29T15:25:38+00:00","triaged_at":"2026-10-29T15:26:43+00:00","updated_at":"2026-10-29T15:26:43+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-29T15:26:43Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"SureDash: stored XSS flaw through version 1.12.3 in WordPress plugin","impact":"medium","summary":"SureDash, a WordPress plugin from Brainstorm Force, has a stored cross-site scripting flaw in versions up to and including 1.12.3. An attacker who can store content in the plugin can run scripts in other users' browsers.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","suredash"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Scripts run in other users' browsers, possibly admin sessions","analyst_note":"Check the NVD entry and the Wordfence or vendor advisory for the fixed version and the vulnerable feature and required role.","how_to_check":"- Check the installed SureDash version in the WordPress admin plugin list, or `wp plugin get suredash --field=version` if WP-CLI is available.\n- Compare the result against the affected range: up to and including `1.12.3`.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the SureDash WordPress plugin at version 1.12.3 or earlier. The flaw is stored XSS, so exposure depends on who can submit content the plugin saves and on whether other users, especially admins, view it. The sources do not say which features or roles are involved.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000682,"input_tokens":4115,"output_tokens":542,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-110881':13A,16A '-2026':12A,15A '1.12.3':7A,41B,85C 'affect':80C 'allow':76C 'attack':43B 'brainstorm':25B,72C 'browser':57B 'content':47B 'cross':31B,67C 'cross-sit':30B,66C 'cve':11A,14A 'flaw':4A,34B 'forc':26B,73C 'generat':65C 'improp':58C 'includ':40B 'input':61C 'issu':79C 'n/a':83C 'neutral':59C 'packag':17B 'page':64C 'plugin':10A,23B,50B 'run':52B 'script':33B,53B,69C 'site':32B,68C 'store':2A,29B,46B,77C 'suredash':1A,18B,20B,74C,75C,81C 'user':56B 'version':6A,36B 'vulner':70C 'web':63C 'wordpress':9A,19B,22B 'xss':3A 'xss.this':78C","nicknames":[],"mitigations":[],"who_affected":"Sites running the SureDash WordPress plugin at version 1.12.3 or earlier. The flaw is stored XSS, so exposure depends on who can submit content the plugin saves and on whether other users, especially admins, view it. The sources do not say which features or roles are involved.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T15:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110881","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110881","severity":null,"published_at":"2026-10-29T15:17:16+00:00","modified_at":"2026-10-29T15:18:54+00:00","first_seen_at":"2026-10-29T15:25:38+00:00","fetched_at":"2026-10-29T15:25:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}