The If-So Dynamic Content WordPress plugin before version 1.10.2 contains a CWE-79 Cross-Site Scripting vulnerability. Specifically, it does not sanitize a conversion name before storing it, nor escape it when rendering the analytics page. This flaw enables users with editor-level privileges to store malicious JavaScript code that executes in the session of users with higher privileges when they access the analytics page.

The vulnerability allows an attacker with editor-level access to execute arbitrary JavaScript in the context of higher-privileged users who view the analytics page. This could lead to limited confidentiality and integrity impacts, such as session hijacking or unauthorized actions within the plugin interface. The CVSS score of 3.1 reflects a low severity impact with network attack vector, high attack complexity, required privileges at the high level, user interaction required, and limited confidentiality and integrity impact without availability impact.

A fixed version of the If-So Dynamic Content plugin is available starting from version 1.10.2. Users should upgrade to version 1.10.2 or later to remediate this vulnerability. Since the vendor advisory is not explicitly provided, patch status is inferred from the version range. No additional mitigation steps are indicated.