The SureDash plugin for WordPress suffers from a stored cross-site scripting vulnerability in all versions up to and including 1.10.3. This vulnerability is due to improper neutralization of input during web page generation, specifically in the 'draweropenverposition' block/shortcode attribute. Authenticated attackers with contributor-level privileges or higher can inject arbitrary JavaScript payloads that are stored in the block-delimiter HTML comment's JSON. The plugin fails to sanitize this input properly on save (wp_kses_post does not neutralize it) and does not escape it correctly on output (missing esc_attr() escaping), allowing the injected payload to break out of the style attribute and execute arbitrary HTML event handlers when the page is rendered.

An attacker with contributor-level access or higher can inject persistent malicious scripts into pages, which execute in the context of users viewing those pages. This can lead to theft of user credentials, session hijacking, or other malicious actions limited to the privileges of the victim user. The vulnerability does not affect unauthenticated users directly but leverages authenticated user privileges to inject the payload.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the SureDash plugin if possible. Monitor vendor channels for updates and apply official patches once released.