If-So Dynamic Content EUVD-2026-111737

Requires an authenticated account with contributor-level capability or above on a WordPress site running If-So Dynamic Content ≤1.10.2, plus the ability to insert the plugin's extended shortcode with a malicious 'url' parameter into a post. Critically, execution is gated: the vulnerable branch only renders when an administrator previews or opens the post containing the crafted shortcode, so the payload does not fire for ordinary visitors and depends on an admin viewing the attacker-controlled post. Limiting factors: authenticated contributor+ access is mandatory (not anonymous), successful impact requires an administrator to open/preview the specific post, and it is scoped to deployments where the If-So extended shortcodes feature is in use.

This is a medium-severity stored XSS (CVSS 6.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) that is a real but bounded priority rather than an emergency. The vuln.today Decision label is 'this_month' (not act_now/emergency), and there is no CISA KEV listing and no EPSS score in the supplied data, so there is no signal of active or widespread exploitation. The input lists no PoC or exploit reference - only the Wordfence advisory, two plugin source lines, and the fix changeset - so this reads as 'no public exploit identified at time of analysis.' The CVSS PR:L reflects the confirmed contributor-level prerequisite, and the scope change (S:C) plus low C/I impact matches a stored script escaping into the administrator's session. One nuance to note: the vector is scored UI:N, but the description states the payload only executes when an administrator previews or opens the crafted post, which is an effective interaction/targeting requirement that constrains real-world exploitation beyond what the raw UI:N implies. Net: a legitimate issue to patch on a normal cycle, not a drop-everything fire.

A user with contributor-level access (or higher) saves a post containing a crafted If-So extended shortcode whose 'url' parameter carries a malicious script, which is stored without sufficient sanitization or output escaping. When an administrator later previews or opens that post - the only branch where the vulnerable code renders - the script executes in the administrator's authenticated browser session, enabling session-context actions such as creating a rogue admin or altering settings. No public exploit code is identified in the available sources.