Skip to content
Sign in
3.1 Low

CVE-2026-87973 The If-So Dynamic Content WordPress plugin before 1.10.2 does not sanitize a conversion name before storing it, nor…

Description

The If-So Dynamic Content WordPress plugin before 1.10.2 does not sanitize a conversion name before storing it, nor escape it when rendering the analytics page, allowing users with editor-level access to store JavaScript that executes in the session of a higher-privileged user who views that page.

Affected products and versions

Product Affected versions Fixed in
If-So Dynamic Content 1.9 1.9.9 → < 1.10.2 1.10.2

Other CVEs of If-So Dynamic Content

The 3 CVEs of If-So Dynamic Content →
CVE-2026-87971 The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value… 7.1 High CVE-2026-87970 The If-So Dynamic Content WordPress plugin before 1.10.2 does not escape a request-supplied value before reflecting… 4.7 Medium
Track this CVE