CVE-2026-87971: CWE-79 Cross-Site Scripting (XSS) in If-So Dynamic Content

The If-So Dynamic Content WordPress plugin versions from 1.4.4 up to but not including 1.10.2 contain a reflected cross-site scripting vulnerability (CWE-79). The vulnerability arises because the plugin does not validate the URL scheme of a user-supplied value before reflecting it into a link on an administrative page. This can be exploited by an attacker to execute arbitrary JavaScript code in the context of a logged-in user's browser when they open a crafted link, potentially leading to session hijacking or other malicious actions within the admin interface.

Successful exploitation allows execution of arbitrary JavaScript in the browser of authenticated users with admin privileges. This can lead to unauthorized actions performed on behalf of the user, theft of sensitive information, or further compromise of the WordPress site. The vulnerability requires the victim to be logged in and to open a maliciously crafted link.

Upgrade the If-So Dynamic Content plugin to version 1.10.2 or later, where this vulnerability is fixed. No other mitigation is indicated. Patch status is not explicitly stated in the input data, but the affected versions are clearly defined as before 1.10.2, implying that 1.10.2 contains the fix.