If So Dynamic Content Elementor All Page Builders Personalization
Monthly
Stored cross-site scripting in the If-So Dynamic Content plugin (Elementor & All Page Builders Personalization) for WordPress, affecting all versions up to and including 1.10.2, lets an attacker who holds contributor-level access or above save malicious script into trigger/condition settings fields, which then executes for any user who views a page rendering that dynamic content. The flaw is insufficient input sanitization and output escaping across the repeater settings parameter and numerous sibling fields (version_uid, freeze-mode, cookie-input, ip-input, compare, utm-value, page-url-compare, group-name, custom). There is no unauthenticated path - exploitation requires an existing account with at least contributor capabilities - which is the main bound on real-world priority; no public exploit code or confirmed active exploitation is identified in the available data (priority label: this_month).
Stored cross-site scripting in the If-So Dynamic Content - Elementor & All Page Builders Personalization plugin for WordPress (all versions up to and including 1.10.2) allows authenticated users with contributor-level access or above to inject arbitrary script into a page through the 'conversion' shortcode attribute, which then executes in the browser of any user who later views that page. The flaw is a sanitization and output-escaping failure in the plugin's extended shortcodes handler, rated CVSS 6.4 with a scope change because the injected script runs in the security context of other users rather than the attacker. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the assessed risk is moderate and not emergency-grade, with the contributor-or-above prerequisite and the need for a victim to open the affected page as the main limiting factors.
Stored cross-site scripting in the WordPress plugin If-So Dynamic Content - Elementor & All Page Builders Personalization affects every version through 1.10.2 and lets an authenticated user with contributor-level access or above plant arbitrary script in a post via the extended shortcode's 'url' parameter. The payload does not fire for ordinary visitors: the vulnerable rendering branch is reached only when an administrator previews or opens the crafted post, so the practical target is the admin's browser session. Rated CVSS 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) with a this_month remediation priority; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
Stored cross-site scripting in the If-So Dynamic Content plugin (Elementor & All Page Builders Personalization) for WordPress, affecting all versions up to and including 1.10.2, lets an attacker who holds contributor-level access or above save malicious script into trigger/condition settings fields, which then executes for any user who views a page rendering that dynamic content. The flaw is insufficient input sanitization and output escaping across the repeater settings parameter and numerous sibling fields (version_uid, freeze-mode, cookie-input, ip-input, compare, utm-value, page-url-compare, group-name, custom). There is no unauthenticated path - exploitation requires an existing account with at least contributor capabilities - which is the main bound on real-world priority; no public exploit code or confirmed active exploitation is identified in the available data (priority label: this_month).
Stored cross-site scripting in the If-So Dynamic Content - Elementor & All Page Builders Personalization plugin for WordPress (all versions up to and including 1.10.2) allows authenticated users with contributor-level access or above to inject arbitrary script into a page through the 'conversion' shortcode attribute, which then executes in the browser of any user who later views that page. The flaw is a sanitization and output-escaping failure in the plugin's extended shortcodes handler, rated CVSS 6.4 with a scope change because the injected script runs in the security context of other users rather than the attacker. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the assessed risk is moderate and not emergency-grade, with the contributor-or-above prerequisite and the need for a victim to open the affected page as the main limiting factors.
Stored cross-site scripting in the WordPress plugin If-So Dynamic Content - Elementor & All Page Builders Personalization affects every version through 1.10.2 and lets an authenticated user with contributor-level access or above plant arbitrary script in a post via the extended shortcode's 'url' parameter. The payload does not fire for ordinary visitors: the vulnerable rendering branch is reached only when an administrator previews or opens the crafted post, so the practical target is the admin's browser session. Rated CVSS 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) with a this_month remediation priority; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.