Aller au contenu
Se connecter
4.7 Moyenne

CVE-2026-87970 The If-So Dynamic Content WordPress plugin before 1.10.2 does not escape a request-supplied value before reflecting…

Description

The If-So Dynamic Content WordPress plugin before 1.10.2 does not escape a request-supplied value before reflecting it in an unauthenticated AJAX response that is served as HTML, allowing attackers to execute arbitrary JavaScript in the browser of a visitor who opens a crafted link.

Produits et versions touchés

Produit Versions touchées Corrigé en
If-So Dynamic Content 1.8 1.8 → < 1.10.2 1.10.2

Autres CVE de If-So Dynamic Content

Les 3 CVE de If-So Dynamic Content →
CVE-2026-87971 The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value… 7.1 Élevée CVE-2026-87973 The If-So Dynamic Content WordPress plugin before 1.10.2 does not sanitize a conversion name before storing it, nor… 3.1 Faible
Suivre cette CVE