CVE-2026-87970
MediumCVSS 4.7Summary
The If-So Dynamic Content WordPress plugin before 1.10.2 does not escape a request-supplied value before reflecting it in an unauthenticated AJAX response served as HTML. This allows attackers to execute arbitrary JavaScript in the browser of a visitor who opens a crafted link.
Risk Assessment
Attackers can execute arbitrary JavaScript in the victim's browser, potentially leading to session theft, redirects, or other attacks. The risk affects any visitor who clicks a crafted link.
Recommendation
Update the If-So Dynamic Content plugin to version 1.10.2 or later. It is also recommended to educate users about avoiding suspicious links.
Other vulnerabilities in If-So Dynamic Content WordPress plugin
See all- CVE-2026-118164Medium
The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress in all versions up to and including 1.10.2 is vulnerable to stored cross-site scripting via the 'repeater[*][version_uid]' parameter and many sibling fields (freeze-mode, cookie-input, ip-input, compare, utm-value, page-url-compare, group-name, custom) due to insufficient input sanitization and output escaping. An authenticated attacker with Contributor-level access can inject arbitrary web scripts that execute when a user accesses an injected page.
- CVE-2026-104740Medium
The If-So Dynamic Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'conversion' Shortcode Attribute in versions up to and including 1.10.2 due to insufficient input sanitization and output escaping. An authenticated attacker with Contributor-level access or higher can inject arbitrary web scripts that execute when a user visits the injected page.
Original NVD description (English source)
The If-So Dynamic Content WordPress plugin before 1.10.2 does not escape a request-supplied value before reflecting it in an unauthenticated AJAX response that is served as HTML, allowing attackers to execute arbitrary JavaScript in the browser of a visitor who opens a crafted link.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS