If-So Dynamic Content CVE-2026-100507

Requires an active WordPress installation running the If-So Dynamic Content Personalization plugin at version 1.10.1 or earlier. Exploitation is unauthenticated (PR:N) and remote (AV:N) but MANDATORILY requires victim user interaction (UI:R) - the target must click a crafted link or load an attacker-influenced page for the payload to reflect and execute; there is no server-side compromise without that interaction. The specific vulnerable parameter/endpoint is not disclosed in the available data, so precise triggering input cannot be named. Impact is confined to script execution in the victim's browser session (C:L/I:L/A:L), not direct server code execution.

This is a moderate-severity, unauthenticated reflected/DOM XSS in the If-So Dynamic Content Personalization WordPress plugin (<=1.10.1), rated CVSS 3.1 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). The network vector, low complexity, and no-privileges requirement make it broadly reachable, but exploitation is gated by user interaction (UI:R) - a victim must be lured into clicking a crafted link or visiting an attacker-controlled page, which meaningfully lowers real-world exploitation likelihood versus a fully wormable flaw. The scope-change (S:C) reflects script executing in the victim's browser context against the WordPress origin, hence the low-but-present C/I/A impacts. Signals are consistent but thin: there is NO EPSS score, NO CISA KEV listing, and NO public POC provided in the input, so exploitation status is 'no public exploit identified at time of analysis.' There is no conflict between the CVSS vector and the description (both indicate unauthenticated network XSS requiring interaction). Net: a genuine issue worth patching promptly on affected sites, but not an emergency - treat as routine-to-elevated remediation rather than active-threat priority, driven mainly by the plugin's WordPress footprint rather than any exploitation evidence.

An attacker crafts a URL or web page containing a malicious payload targeting the vulnerable If-So parameter and lures a site visitor or administrator into clicking it. When the page renders, unsanitized input is reflected into the DOM and the attacker's JavaScript executes in the victim's browser under the WordPress site's origin, enabling session/cookie theft or actions on behalf of the victim. No public exploit code was identified in the provided data, and successful exploitation depends on the victim performing the required interaction.