If-So Dynamic Content CVE-2026-118164

Requires an authenticated account with contributor-level capabilities or above on the target WordPress site (PR:L), used to save a trigger/condition configuration in the If-So Dynamic Content plugin; the payload is injected through the 'repeater[*]' settings fields (version_uid and siblings such as freeze-mode, cookie-input, ip-input, compare, utm-value, page-url-compare, group-name, custom) handled in the plugin's trigger settings metabox and settings class. Execution is deferred until any user renders a page containing the injected dynamic content. Limiting factors: there is no anonymous/unauthenticated path - the attacker must already possess at least contributor access - confining this to sites that grant such accounts to semi-trusted users; affects all versions up to and including 1.10.2.

This is a moderate-severity stored XSS (CVSS 6.4) whose real-world priority is bounded primarily by its authentication requirement. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N confirms network reach and low complexity, but PR:L means the attacker must already hold a contributor-level (or higher) account on the target WordPress site, which substantially limits the pool of potential abusers to users already granted content-authoring access. The scope change (S:C) and low C/I impacts reflect that injected script executes in the browser of whoever later views the page, affecting a security authority different from the vulnerable plugin. No EPSS score was supplied in the input and the CVE is not listed in CISA KEV, so there is no signal of active exploitation; the vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a patch-this-cycle rather than drop-everything posture. There is no confirmed public exploit code - the references are a Wordfence advisory, plugin source lines, and the fix changeset, not a working PoC. Net: a real but not urgent issue - genuine stored XSS in a widely-installed plugin, meaningfully gated by the contributor-access prerequisite rather than a high-CVSS/low-real-risk false alarm, but not an emergency absent exploitation evidence.

An attacker holding (or phishing/registering into) a contributor-level account on a WordPress site running If-So Dynamic Content submits a trigger configuration whose repeater fields (e.g. version_uid, utm-value, page-url-compare, group-name, custom) contain a malicious script payload that is stored without adequate sanitization. When an administrator or visitor subsequently loads a page rendering that dynamic content, the script executes in their browser session. No public working exploit code is identified at time of analysis, though the vulnerable sink and the fix are visible in the referenced plugin source and changeset.