CVE-2026-102774: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in brainstormforce SureDash – Community, Courses & Member Dashboard

CVE-2026-102774 is a stored DOM-based cross-site scripting vulnerability in the SureDash – Community, Courses & Member Dashboard WordPress plugin affecting all versions up to and including 1.12.1. The flaw exists due to improper neutralization of input during web page generation, specifically in the handling of the image 'alt' attribute within community post content. Authenticated attackers with subscriber-level privileges or higher can inject entity-encoded scripts that bypass the server-side wp_kses filtering because the filtering permits the img/alt tag combination and does not normalize entities inside attribute values. The payload is decoded client-side when the GLightbox library reads the .alt DOM property and assigns it to innerHTML, leading to script execution in users' browsers.

An attacker with subscriber-level access or higher can inject arbitrary web scripts into community post content that execute in the context of other users viewing the affected pages. This can lead to theft of user credentials, session hijacking, or other malicious actions performed with the privileges of the victim user. The vulnerability does not affect availability but impacts confidentiality and integrity of user data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict subscriber-level users from posting untrusted content or disable the affected plugin functionality if possible. Monitor vendor channels for updates and apply official fixes once released.