CVE-2026-18402 is a stored cross-site scripting vulnerability in the SureDash – Community, Courses & Member Dashboard WordPress plugin. The issue affects all versions up to and including 1.10.3. The vulnerability stems from insufficient sanitization and escaping of the 'draweropenverposition' block/shortcode attribute. Authenticated attackers with contributor-level or higher privileges can inject malicious JavaScript payloads stored inside block-delimiter HTML comment JSON. These payloads bypass wp_kses_post filtering on save and are interpolated into a style attribute without esc_attr() escaping, enabling a double-quote injection that breaks out of the attribute context and allows arbitrary HTML event handlers to execute in users' browsers.

An attacker with contributor-level or higher access can perform stored cross-site scripting attacks, leading to the execution of arbitrary scripts in the context of users viewing the injected pages. This can result in information disclosure and limited integrity impact. The CVSS v3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and combined confidentiality and integrity impacts without availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or limiting use of the affected shortcode/block attribute. Monitor vendor communications for updates and apply patches promptly once released.