Skip to content
Sign in
4.7 Medium

CVE-2026-87970 The If-So Dynamic Content WordPress plugin before 1.10.2 does not escape a request-supplied value before reflecting…

Description

The If-So Dynamic Content WordPress plugin before 1.10.2 does not escape a request-supplied value before reflecting it in an unauthenticated AJAX response that is served as HTML, allowing attackers to execute arbitrary JavaScript in the browser of a visitor who opens a crafted link.

Affected products and versions

Product Affected versions Fixed in
If-So Dynamic Content 1.8 1.8 → < 1.10.2 1.10.2

Other CVEs of If-So Dynamic Content

The 3 CVEs of If-So Dynamic Content →
CVE-2026-87971 The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value… 7.1 High CVE-2026-87973 The If-So Dynamic Content WordPress plugin before 1.10.2 does not sanitize a conversion name before storing it, nor… 3.1 Low
Track this CVE