Skip to content
Sign in
7.1 High

CVE-2026-87971 The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value…

Description

The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin page, allowing attackers to execute arbitrary JavaScript in the browser of a logged-in user who opens a crafted link.

Affected products and versions

Product Affected versions Fixed in
If-So Dynamic Content 1.4 1.4.4 → < 1.10.2 1.10.2

Other CVEs of If-So Dynamic Content

The 3 CVEs of If-So Dynamic Content →
CVE-2026-87973 The If-So Dynamic Content WordPress plugin before 1.10.2 does not sanitize a conversion name before storing it, nor… 3.1 Low CVE-2026-87970 The If-So Dynamic Content WordPress plugin before 1.10.2 does not escape a request-supplied value before reflecting… 4.7 Medium
Track this CVE