CVE-2026-87970

The If-So Dynamic Content WordPress plugin (versions 1.8 through 1.10.1 ) is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw in the render_ifso_shortcodes function. The vulnerability exists because the plugin fails to properly escape request-supplied values before reflecting them in an ...

CVE-2026-87973 If-So Dynamic Content 1.9.9 - 1.10.1 - Editor+ Stored XSS via Conversion Name

The If-So Dynamic Content WordPress plugin before 1.10.2 does not sanitize a conversion name before storing it, nor escape it when rendering the analytics page, allowing users with editor-level access to store JavaScript that executes in the session of a higher-privileged user who views that page...

CVE-2026-87973 If-So Dynamic Content 1.9.9 - 1.10.1 - Editor+ Stored XSS via Conversion Name

The If-So Dynamic Content WordPress plugin before 1.10.2 does not sanitize a conversion name before storing it, nor escape it when rendering the analytics page, allowing users with editor-level access to store JavaScript that executes in the session of a higher-privileged user who views that page...

WordPress If-So Dynamic Content plugin 1.9.9-1.10.1 - Editor+ Stored XSS vulnerability

Editor+ Stored XSS vulnerability discovered by Kaan Özbek in WordPress Plugin If-So Dynamic Content Personalization versions 1.9.9-1.10.1...

CVE-2026-87970 If-So Dynamic Content 1.8 - 1.10.1 - Reflected XSS via render_ifso_shortcodes

The If-So Dynamic Content WordPress plugin before 1.10.2 does not escape a request-supplied value before reflecting it in an unauthenticated AJAX response that is served as HTML, allowing attackers to execute arbitrary JavaScript in the browser of a visitor who opens a crafted link...

CVE-2026-87970 If-So Dynamic Content 1.8 - 1.10.1 - Reflected XSS via render_ifso_shortcodes

The If-So Dynamic Content WordPress plugin before 1.10.2 does not escape a request-supplied value before reflecting it in an unauthenticated AJAX response that is served as HTML, allowing attackers to execute arbitrary JavaScript in the browser of a visitor who opens a crafted link...

EUVD-2026-90513

The If-So Dynamic Content WordPress plugin before 1.10.2 does not sanitize a conversion name before storing it, nor escape it when rendering the analytics page, allowing users with editor-level access to store JavaScript that executes in the session of a higher-privileged user who views that page...

CVE-2026-87970: Improper Neutralization of Input During Web Page Generation

The If-So Dynamic Content WordPress plugin before 1.10.2 does not escape a request-supplied value before reflecting it in an unauthenticated AJAX response that is served as HTML, allowing attackers to execute arbitrary JavaScript in the browser of a visitor who opens a crafted link...

PT-2026-103702

The If-So Dynamic Content WordPress plugin before 1.10.2 does not escape a request-supplied value before reflecting it in an unauthenticated AJAX response that is served as HTML, allowing attackers to execute arbitrary JavaScript in the browser of a visitor who opens a crafted link...

PT-2026-103703

The If-So Dynamic Content WordPress plugin before 1.10.2 does not sanitize a conversion name before storing it, nor escape it when rendering the analytics page, allowing users with editor-level access to store JavaScript that executes in the session of a higher-privileged user who views that page...

CVE-2026-87973: Improper Neutralization of Input During Web Page Generation

The If-So Dynamic Content WordPress plugin before 1.10.2 does not sanitize a conversion name before storing it, nor escape it when rendering the analytics page, allowing users with editor-level access to store JavaScript that executes in the session of a higher-privileged user who views that page...

CVE-2026-100507

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in If-So Dynamic Content If-So Dynamic Content Personalization if-so allows Reflected XSS.This issue affects If-So Dynamic Content Personalization: from n/a through 1.10.1...

CVE-2026-100507

The If-So Dynamic Content Personalization plugin for WordPress, version

CVE-2026-100507 WordPress If-So Dynamic Content Personalization plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in If-So Dynamic Content If-So Dynamic Content Personalization if-so allows Reflected XSS.This issue affects If-So Dynamic Content Personalization: from n/a through 1.10.1...

EUVD-2026-89937

Unauthenticated Cross Site Scripting XSS in If-So Dynamic Content Personalization = 1.10.1 versions...

CVE-2026-100507 WordPress If-So Dynamic Content Personalization plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in If-So Dynamic Content If-So Dynamic Content Personalization if-so allows Reflected XSS.This issue affects If-So Dynamic Content Personalization: from n/a through 1.10.1...

WordPress If-So Dynamic Content Personalization plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin If-So Dynamic Content Personalization versions = 1.10.1...

PT-2026-103136

Name of the Vulnerable Software and Affected Versions If-So Dynamic Content Personalization versions prior to 1.10.2 Description Unauthenticated Cross Site Scripting XSS allows an attacker to execute malicious scripts in the browser of a user without requiring authentication. Recommendations Upda...

CVE-2026-100507: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in If-So Dynamic Content Personalization = 1.10.1 versions...

CVE-2026-83483

Vulnerability in the Oracle Advanced Benefits product of Oracle E-Business Suite component: Self-serv What-if Analysis. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle...