SureDash <= 1.12.1 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute in Community Post Content

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-102774 · Microsoft / collected KEV context

cve-program · CVE-2026-102774

• https://www.wordfence.com/threat-intel/vulnerabilities/id/a8b5b389-85f4-4cc5-9796-55b611af7916?source=cve
• https://plugins.trac.wordpress.org/browser/suredash/tags/1.12.0/assets/js/minified/lightbox.min.js
• https://plugins.trac.wordpress.org/browser/suredash/tags/1.12.0/core/routers/misc.php#L59
• https://plugins.trac.wordpress.org/browser/suredash/tags/1.12.0/core/routes.php#L101
• https://plugins.trac.wordpress.org/browser/suredash/tags/1.12.0/inc/services/router.php#L127
• https://plugins.trac.wordpress.org/browser/suredash/tags/1.12.0/inc/utils/post-meta.php#L377
• https://plugins.trac.wordpress.org/changeset?reponame=&new=3724179%40suredash%2Ftags%2F1.12.2&old=3694773%40suredash%2Ftags%2F1.12.0

No related operational record is retained in the current change model.