JavaScript Injection Vulnerability in If-So Dynamic Content Plugin for WordPress
CVE-2026-87973
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 1 October 2026
Badges
What is CVE-2026-87973?
The If-So Dynamic Content plugin for WordPress prior to version 1.10.2 is susceptible to a JavaScript injection vulnerability. This issue arises because the plugin fails to properly sanitize conversion names before saving them and does not escape content during the rendering of the analytics page. Consequently, an attacker with editor-level access can inject malicious JavaScript that executes within the session of any higher-privileged user who views that particular page, leading to potential unauthorized actions or data compromise.
Affected Version(s)
If-So Dynamic Content 1.9.9 < 1.10.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.