CVE-2026-15821 is a stored cross-site scripting vulnerability in the SureDash – Community, Courses & Member Dashboard plugin for WordPress. The issue exists in all versions up to and including 1.10.0 due to insufficient sanitization and escaping of shortcode attribute inputs. Authenticated attackers with contributor or higher privileges can inject arbitrary JavaScript code that executes in the context of users visiting the compromised pages. This vulnerability can lead to partial confidentiality and integrity impacts but does not affect availability. No official patch or remediation level has been documented in the provided data.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via shortcode attributes. These scripts execute in the browsers of users who visit the injected pages, potentially leading to unauthorized actions or data exposure within the scope of the affected site. The confidentiality and integrity of user interactions may be compromised. There is no indication of availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider removing or disabling the SureDash plugin if possible. Monitor vendor channels for updates or patches addressing this vulnerability.