SureDash – Community, Courses & Member Dashboard <= 1.12.4 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Notification Content
- ID
- WPSEC-2026-2648
- Plugin
- SureDash – Community, Courses & Member Dashboard (suredash)
- Affected
- all versions before 1.13.0
- Remediation
- Update to 1.13.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- Weakness
- CWE-94
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-06
- Attack surface
- SureDash – Community, Courses & Member Dashboard on WPSec AttackSurface
- Fix released
- Published
Description
The SureDash plugin for WordPress is vulnerable to Arbitrary Shortcode Execution via notification content in all versions up to, and including, 1.12.4, due to the notification row markup being passed to do_shortcode() without neutralising shortcode brackets. The row includes the acting member's display name and, depending on the notification, post titles and comment excerpts. This makes it possible for authenticated attackers, with subscriber-level access and above, to put shortcode syntax in their display name and trigger a notification to another user, for example by mentioning them, commenting on their post or liking it. The shortcodes then run when that user, including an administrator, views their notifications.
References
- https://wpsec.com/vuln/WPSEC-2026-2648/
- https://plugins.svn.wordpress.org/suredash/tags/1.13.0/
- https://wordpress.org/plugins/suredash/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS