CVE-2026-100507

HighCVSS 7.1

Published: 30/09/2026(UTC)Updated: 07/10/2026(UTC)Translated: 07/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

The If-So Dynamic Content Personalization WordPress plugin through 1.10.1 is vulnerable to Reflected XSS due to improper neutralization of input during web page generation.

Risk Assessment

An attacker can execute arbitrary JavaScript in the user's browser, potentially leading to session or data theft.

Recommendation

Update the If-So Dynamic Content Personalization plugin to a version later than 1.10.1.

Other vulnerabilities in If-So Dynamic Content Personalization

CVE-2026-66446Critical
The If-So Dynamic Content Personalization plugin versions up to 1.10 contain a Subscriber SQL Injection vulnerability. An attacker with a subscriber account can send specially crafted queries that can manipulate the database.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in If-So Dynamic Content If-So Dynamic Content Personalization if-so allows Reflected XSS.This issue affects If-So Dynamic Content Personalization: from n/a through 1.10.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS