What’s Vulnerable › Vulnerabilities
CVE-2026-87970: If-So Dynamic Content 1.8 - 1.10.1 - Reflected XSS via render_ifso_shortcodes
- Severity: medium (CVSS 4.7 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-01 · updated 2026-10-01
- Weakness: CWE-79
Description
The If-So Dynamic Content WordPress plugin before 1.10.2 does not escape a request-supplied value before reflecting it in an unauthenticated AJAX response that is served as HTML, allowing attackers to execute arbitrary JavaScript in the browser of a visitor who opens a crafted link.
Affected products
- If-So Dynamic Content: from 1.8 before 1.10.2 — fixed in 1.10.2
How to fix
Upgrade to a fixed version: If-So Dynamic Content 1.10.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-87970 or the next vulnerability affects your stack