If-So Dynamic Content CVE-2026-104740

Exploitation requires an authenticated account with contributor-level privileges or higher on a WordPress site where the If-So Dynamic Content plugin (version ≤1.10.2) is installed and active, and the attacker must be able to insert the plugin's 'conversion' shortcode with a malicious attribute into content. The payload is stored, so the script fires only when another user (visitor, editor, or administrator) subsequently accesses the page containing the injected shortcode. Limiting factors: the contributor-or-above authentication requirement (no anonymous exploitation), dependence on the plugin being installed/active, and the need for a victim to view the affected page for impact to occur.

This is a moderate, not emergency-grade, risk. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, 6.4) indicates a network-reachable, low-complexity stored XSS that requires authentication at contributor level (PR:L) and no user interaction to inject, with a scope change (S:C) because injected script executes in the browsers of other users who view the page. The practical barrier is the PR:L requirement: an attacker must already hold a contributor-or-above account on the target WordPress site, which limits mass, unauthenticated exploitation and makes this most relevant to multi-author sites or sites where low-privilege accounts can be registered. No EPSS score, CISA KEV listing, or public exploit was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the only exploitation signal is the vendor (Wordfence) report and a committed patch. The vuln.today decision label is 'this_month', consistent with a real but non-urgent remediation priority rather than an act-now/emergency classification. No signals conflict here - all point to a genuine but authentication-gated, lower-impact (C:L/I:L/A:N) stored XSS.

An attacker who holds or obtains a contributor-level account on a WordPress site running If-So Dynamic Content submits content containing the 'conversion' shortcode with a crafted attribute carrying a JavaScript payload, which is stored without sufficient sanitization. When an administrator, editor, or site visitor later views the page rendering that shortcode, the script executes in their browser session. No public exploit code was provided in the input.