70 matches found
CVE-2026-87973
The If-So Dynamic Content WordPress plugin before 1.10.2 does not sanitize a conversion name before storing it, nor escape it when rendering the analytics page, allowing users with editor-level access to store JavaScript that executes in the session of a higher-privileged user who views that page...
CVE-2026-87970
The If-So Dynamic Content WordPress plugin before 1.10.2 does not escape a request-supplied value before reflecting it in an unauthenticated AJAX response that is served as HTML, allowing attackers to execute arbitrary JavaScript in the browser of a visitor who opens a crafted link...
CVE-2026-87970 If-So Dynamic Content 1.8 - 1.10.1 - Reflected XSS via render_ifso_shortcodes
The If-So Dynamic Content WordPress plugin before 1.10.2 does not escape a request-supplied value before reflecting it in an unauthenticated AJAX response that is served as HTML, allowing attackers to execute arbitrary JavaScript in the browser of a visitor who opens a crafted link...
CVE-2026-87973 If-So Dynamic Content 1.9.9 - 1.10.1 - Editor+ Stored XSS via Conversion Name
The If-So Dynamic Content WordPress plugin before 1.10.2 does not sanitize a conversion name before storing it, nor escape it when rendering the analytics page, allowing users with editor-level access to store JavaScript that executes in the session of a higher-privileged user who views that page...
CVE-2026-87973
The If-So Dynamic Content WordPress plugin before 1.10.2 does not sanitize a conversion name before storing it, nor escape it when rendering the analytics page, allowing users with editor-level access to store JavaScript that executes in the session of a higher-privileged user who views that page...
EUVD-2026-90512
The If-So Dynamic Content WordPress plugin before 1.10.2 does not escape a request-supplied value before reflecting it in an unauthenticated AJAX response that is served as HTML, allowing attackers to execute arbitrary JavaScript in the browser of a visitor who opens a crafted link...
EUVD-2026-90513
The If-So Dynamic Content WordPress plugin before 1.10.2 does not sanitize a conversion name before storing it, nor escape it when rendering the analytics page, allowing users with editor-level access to store JavaScript that executes in the session of a higher-privileged user who views that page...
CVE-2026-87970
The If-So Dynamic Content WordPress plugin before 1.10.2 does not escape a request-supplied value before reflecting it in an unauthenticated AJAX response that is served as HTML, allowing attackers to execute arbitrary JavaScript in the browser of a visitor who opens a crafted link...
CVE-2026-100507
Unauthenticated Cross Site Scripting XSS in If-So Dynamic Content Personalization = 1.10.1 versions...
EUVD-2026-89937
Unauthenticated Cross Site Scripting XSS in If-So Dynamic Content Personalization = 1.10.1 versions...
CVE-2026-100507
The If-So Dynamic Content Personalization plugin for WordPress, version
CVE-2026-100507 WordPress If-So Dynamic Content Personalization plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in If-So Dynamic Content Personalization = 1.10.1 versions...
CVE-2026-66446
Subscriber SQL Injection in If-So Dynamic Content Personalization = 1.10 versions...
CVE-2026-66446
CVE-2026-66446 : Concrete details across connected sources show a SQL Injection vulnerability in WordPress plugin If-So Dynamic Content Personalization affecting versions
CVE-2026-66446
Subscriber SQL Injection in If-So Dynamic Content Personalization = 1.10 versions...
CVE-2026-66446 WordPress If-So Dynamic Content Personalization plugin <= 1.10 - SQL Injection vulnerability
Subscriber SQL Injection in If-So Dynamic Content Personalization = 1.10 versions...
EUVD-2026-57870
Subscriber SQL Injection in If-So Dynamic Content Personalization = 1.10 versions...
CVE-2026-66446 WordPress If-So Dynamic Content Personalization plugin <= 1.10 - SQL Injection vulnerability
Subscriber SQL Injection in If-So Dynamic Content Personalization = 1.10 versions...
