https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 11 Oct 2026 22:38:10 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-102774 <p>The SureDash – Community, Courses &amp; Member Dashboard plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Image &#39;alt&#39; Attribute in Community Post Content in all versions up to, and including, 1.12.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The entity-encoded payload bypasses server-side wp_kses filtering because kses permits the img/alt tag combination and does not normalize entities inside attribute values; the decode occurs client-side when GLightbox reads the .alt DOM property and assigns the result to innerHTML.</p> <p>The SureDash – Community, Courses &amp; Member Dashboard plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Image &#39;alt&#39; Attribute in Community Post Content in all versions up to, and including, 1.12.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The entity-encoded payload bypasses server-side wp_kses filtering because kses permits the img/alt tag combination and does not normalize entities inside attribute values; the decode occurs client-side when GLightbox reads the .alt DOM property and assigns the result to innerHTML.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-102774 https://vulnerability.circl.lu/vuln/ghsa-hv84-qp5f-whrj <p>The SureDash – Community, Courses &amp; Member Dashboard plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Image &#39;alt&#39; Attribute in Community Post Content in all versions up to, and including, 1.12.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The entity-encoded payload bypasses server-side wp_kses filtering because kses permits the img/alt tag combination and does not normalize entities inside attribute values; the decode occurs client-side when GLightbox reads the .alt DOM property and assigns the result to innerHTML.</p> <p>The SureDash – Community, Courses &amp; Member Dashboard plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Image &#39;alt&#39; Attribute in Community Post Content in all versions up to, and including, 1.12.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The entity-encoded payload bypasses server-side wp_kses filtering because kses permits the img/alt tag combination and does not normalize entities inside attribute values; the decode occurs client-side when GLightbox reads the .alt DOM property and assigns the result to innerHTML.</p> https://vulnerability.circl.lu/vuln/ghsa-hv84-qp5f-whrj