If-So Dynamic Content CVE-2026-87970

Requires that the vulnerable If-So Dynamic Content plugin (versions 1.8 through before 1.10.2) be installed and active on a WordPress site; the vulnerable AJAX endpoint is reachable without authentication (PR:N). The decisive limiting factor is required user interaction (UI:R): a visitor must open an attacker-crafted link containing the reflected payload - the script does not execute passively. Because it is reflected rather than stored, each victim must be individually lured, confining practical exploitation to targeted phishing/social-engineering campaigns. No special non-default configuration is noted as required beyond having the plugin active.

This is a reflected (non-persistent) XSS in the If-So Dynamic Content WordPress plugin, scored CVSS 4.7 (MEDIUM). The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N shows the attractive part - network-reachable, low complexity, and no authentication (PR:N) because the vulnerable AJAX endpoint is unauthenticated - tempered by two meaningful limiters: UI:R means a victim must open an attacker-crafted link, and impact is confined to C:L (script execution in the victim's browser) with no integrity or availability impact. The scope change (S:C) correctly reflects that injected script executes in the site's origin rather than the plugin's own boundary. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or automated exploitation; this is a credible but not high-urgency issue. Reflected XSS requiring user interaction is typically used in targeted phishing/social-engineering rather than mass exploitation, so real-world risk is moderate and gated by the social-engineering step. Prioritize patching but this is not a drop-everything flaw.

An attacker crafts a URL to the site's unauthenticated If-So AJAX endpoint embedding malicious JavaScript in a request parameter that is reflected unescaped into an HTML response. The attacker distributes this link (phishing email, malicious ad, forum post); when a visitor clicks it, the script executes in their browser in the site's origin, enabling session/cookie theft or UI redressing. No public POC was identified at time of analysis, and exploitation depends on the victim opening the crafted link (UI:R).