{
 "id": "WPSEC-2026-2648",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2648/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2648/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2648/index.md",
 "title": "SureDash – Community, Courses & Member Dashboard <= 1.12.4 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Notification Content",
 "description": "The SureDash plugin for WordPress is vulnerable to Arbitrary Shortcode Execution via notification content in all versions up to, and including, 1.12.4, due to the notification row markup being passed to do_shortcode() without neutralising shortcode brackets. The row includes the acting member's display name and, depending on the notification, post titles and comment excerpts. This makes it possible for authenticated attackers, with subscriber-level access and above, to put shortcode syntax in their display name and trigger a notification to another user, for example by mentioning them, commenting on their post or liking it. The shortcodes then run when that user, including an administrator, views their notifications.",
 "plugin": {
  "slug": "suredash",
  "name": "SureDash – Community, Courses & Member Dashboard",
  "full_name": "SureDash – Community, Courses & Member Dashboard",
  "wordpress_org": "https://wordpress.org/plugins/suredash/",
  "advisories_url": "https://wpsec.com/vuln/plugin/suredash/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/suredash"
 },
 "type": "UNKNOWN",
 "cwe": [
  "CWE-94"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.13.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.13.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.13.0",
 "remediation": "Update to 1.13.0 or later.",
 "fix_released": "2026-11-05T11:35:31+00:00",
 "published": "2026-11-06T12:43:54+00:00",
 "updated": "2026-11-06T12:02:58.105816+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2648/",
  "https://plugins.svn.wordpress.org/suredash/tags/1.13.0/",
  "https://wordpress.org/plugins/suredash/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/suredash",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-06"
 }
}