JavaScript Injection Vulnerability in If-So Dynamic Content Plugin for WordPress
CVE-2026-87971
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 7 October 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-87971?
The If-So Dynamic Content WordPress plugin prior to version 1.10.2 fails to validate the URL scheme of user-supplied values. This oversight allows attackers to inject arbitrary JavaScript code into admin pages. If a logged-in user clicks on a crafted link, it could lead to the execution of malicious scripts, compromising site security and potentially leading to data breaches.
Affected Version(s)
If-So Dynamic Content 1.4.4 < 1.10.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.