CVE-2026-87973
Received Received - Intake

Stored Cross-Site Scripting in If-So Dynamic Content WordPress Plugin

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: WPScan

Description
The If-So Dynamic Content WordPress plugin before 1.10.2 does not sanitize a conversion name before storing it, nor escape it when rendering the analytics page, allowing users with editor-level access to store JavaScript that executes in the session of a higher-privileged user who views that page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-01
Last Modified
2026-10-01
Generated
2026-10-01
AI Q&A
2026-10-01
EPSS Evaluated
N/A
NVD
CVE-2026-87973
EUVD
EUVD-2026-90513

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
if-so_dynamic_content if-so_dynamic_content From 1.9.9 (inc) to 1.10.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored Cross-Site Scripting (XSS) vulnerability in the If-So Dynamic Content WordPress plugin. It allows users with editor-level access to inject malicious JavaScript code by storing unsanitized conversion names. When a higher-privileged user views the analytics page, the injected script executes in their session.

Detection Guidance

Check the installed version of the If-So Dynamic Content plugin. If it is between 1.9.9 and 1.10.1, the system is vulnerable. Use commands like 'wp plugin list' in WordPress or inspect the plugin directory for version details.

Impact Analysis

An attacker with editor access could steal session cookies, perform actions on behalf of higher-privileged users, or redirect users to malicious sites. This compromises the security of the WordPress site and its users.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's data protection requirements or HIPAA's security rules. Organizations may face legal penalties, reputational damage, and loss of trust if such incidents occur.

Mitigation Strategies

Update the If-So Dynamic Content plugin to version 1.10.2 or later immediately. Remove editor-level access for untrusted users until the update is applied to prevent potential exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-87973. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart