CVE-2026-96870: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in brainstormforce SureDash – Community, Courses & Member Dashboard

CVE-2026-96870 is a stored cross-site scripting vulnerability in the SureDash – Community, Courses & Member Dashboard WordPress plugin. The flaw exists in all versions up to and including 1.12.0, where the 'display_name' parameter is insufficiently sanitized and escaped. Authenticated attackers with subscriber-level privileges or above can inject arbitrary scripts that execute in other users' browsers when they hover over the comment like counter tooltip. The vulnerability arises because the plugin assigns attacker-controlled data-tooltip-description attribute values directly to innerHTML, causing the browser to re-parse and execute the injected HTML/JavaScript.

An attacker with subscriber-level access or higher can inject persistent malicious scripts that execute in the context of other users visiting the affected pages. This can lead to information disclosure, session hijacking, or other client-side impacts. The vulnerability does not affect availability and requires user interaction (hovering) to trigger.

No official patch or fix is currently documented. Users should monitor the vendor advisory for updates. Until a fix is available, restrict subscriber-level user permissions where possible and consider disabling or limiting the use of the affected plugin. Applying input sanitization and output escaping on the 'display_name' parameter is necessary to prevent exploitation.