ifso vulnerabilities and threats

The If-So Dynamic Content – Elementor & All Page Builders Personalization WordPress plugin versions up to 1.10.2 contain a stored cross-site scripting (XSS) vulnerability. Authenticated users with contributor-level access or higher can inject malicious scripts via multiple parameters, including 'repeater[*][version_uid]' and others. These scripts execute when any user visits the affected page, potentially compromising user data and session integrity.

The If-So Dynamic Content – Elementor & All Page Builders Personalization WordPress plugin versions up to 1.10.2 are vulnerable to stored cross-site scripting (XSS) via the 'conversion' shortcode attribute. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages.

The If-So Dynamic Content – Elementor & All Page Builders Personalization WordPress plugin versions up to 1.10.2 contain a stored cross-site scripting (XSS) vulnerability via the 'url' parameter. Authenticated users with contributor-level access or higher can inject malicious scripts that execute in administrator browser sessions when previewing or opening affected posts. This vulnerability arises from insufficient input sanitization and output escaping.

The If-So Dynamic Content Personalization plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.2.1 via the 'ifso-show-post' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created via Elementor that they should not have access to.