WordPress Plugin Vulnerabilities

If-So Dynamic Content 1.9.9 - 1.10.1 - Editor+ Stored XSS via Conversion Name

Description

The plugin does not sanitize a conversion name before storing it, nor escape it when rendering the analytics page, allowing users with editor-level access to store JavaScript that executes in the session of a higher-privileged user who views that page.

Proof of Concept

Affects Plugins

Plugin icon
if-so
Fixed in 1.10.2

References

CVE
CVE-2026-87973

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
3.1 (low)

Miscellaneous

Original Researcher
Kaan Özbek
Submitter
Kaan Özbek
Verified
Yes
WPVDB ID
7a141824-aabf-40a1-8021-ffd1dc4a2f7d

Timeline

Publicly Published
2026-09-29 (about 2 days ago)
Added
2026-09-29 (about 1 day ago)
Last Updated
2026-09-29 (about 1 day ago)

Other

Published
Title
Published
2026-05-16
Title
GiveWP – Donation Plugin and Fundraising Platform < 4.14.6 - Unauthenticated Stored Cross-Site Scripting
Published
2022-11-17
Title
Ultimate Tables <= 1.6.5 - Reflected Cross-Site Scripting
Published
2024-05-30
Title
Random Banner <= 4.2.11 - Admin+ Stored XSS
Published
2025-11-04
Title
Graphina – Elementor Charts and Graphs < 3.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Chart Widgets
Published
2019-10-14
Title
WordPress <= 5.2.3 - Stored XSS in Style Tags