CVE-2026-87970: If-So Dynamic Content 1.8 - 1.10.1 - Reflected XSS via render_ifso_shortcodes
The If-So Dynamic Content WordPress plugin before 1.10.2 does not escape a request-supplied value before reflecting it in an unauthenticated AJAX response that is served as HTML, allowing attackers to execute arbitrary JavaScript in the browser of a visitor who opens a crafted link.
Affected Software
Event History
Frequently Asked Questions
Which installations are affected?
If-So Dynamic Content versions before 1.10.2 are affected. Versions 1.8 through 1.10.1 are identified as vulnerable.
Does exploiting this issue require authentication?
No. The vulnerable AJAX response is accessible without authentication, so an attacker does not need a WordPress account to supply the reflected value.
What must an attacker do to exploit the issue?
The attacker must craft a link containing a malicious request-supplied value and convince a visitor to open it. JavaScript executes in the browser of the visitor who follows the crafted link.
What is the remediation?
Update If-So Dynamic Content to version 1.10.2 or later. The issue affects releases before 1.10.2.