Stored XSS via unescaped style attribute

Stored XSS in SureDash for WordPress through 1.10.3 allows remote authenticated users to execute script via a crafted draweropenverposition attribute. The vulnerable block and shortcode paths store that attribute inside block-delimiter JSON that wp_kses_post leaves intact, then copy it into a rendered style attribute without esc_attr() escaping, so an injected quote can break attribute context and add event-handler markup. Exploitation requires contributor-level or higher access to create or edit affected content, and the payload runs in the browser of anyone who loads the injected page rather than directly on the server.