If-So Dynamic Content CVE-2026-87971

Exploitation requires the vulnerable If-So Dynamic Content plugin (versions 1.4.4 through below 1.10.2) to be installed and active, and depends on a reflected value whose URL scheme is not validated before being rendered into a link on an admin page. The limiting factors are significant: a logged-in user - effectively a WordPress administrator with access to the affected admin page - must actively open the attacker-crafted link (UI:R), so the attack cannot succeed against unauthenticated-only visitors and relies on social engineering of a privileged user. It is non-persistent (reflected), so each victim must be individually lured; no attacker authentication is needed (PR:N).

This is a reflected cross-site scripting flaw (CWE-79) in the If-So Dynamic Content WordPress plugin, scored CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). The network vector and low attack complexity favor the attacker, and PR:N means the attacker needs no account - but UI:R is the decisive mitigating signal: exploitation requires a logged-in (typically admin) user to be socially engineered into clicking an attacker-crafted link, so this is not a wormable or auto-triggering issue. Publicly available exploit code exists (WPScan), which raises practical risk and lowers the skill barrier, but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation at this time. No SSVC decision data was supplied. On balance this is a moderate, patch-promptly issue rather than an emergency: the combination of required user interaction, admin-context targeting, and reflected (non-persistent) nature means it depends on phishing a privileged user rather than mass unauthenticated compromise. A patch (1.10.2) is available from the vendor, so remediation is straightforward.

An attacker crafts a malicious URL for a vulnerable If-So Dynamic Content admin page where a request-supplied value is reflected into a link without URL-scheme validation (e.g., injecting a javascript: scheme). The attacker phishes a logged-in WordPress administrator into opening the link; when the admin views the page and the tainted link executes, arbitrary JavaScript runs in their authenticated browser context, enabling session/action abuse such as creating rogue admins or altering settings. Public exploit code for this reflected XSS is available via WPScan, lowering the effort required.