{"id":"CVE-2026-121782","kind":"vulnerability","aliases":["CVE-2026-121782"],"related":[],"title":"If-So Dynamic Content WordPress plugin: reflected XSS through 1.10.3","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in If-So Dynamic Content If-So Dynamic Content Personalization if-so allows Reflected XSS.This issue affects If-So Dynamic Content Personalization: from n/a through 1.10.3.","summary":"The If-So Dynamic Content Personalization plugin for WordPress does not neutralize input in some pages, allowing reflected cross-site scripting. An attacker can run script in a visitor's browser by tricking them into opening a crafted link.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"if-so","fixed":["1.10.4"],"affected":"<= 1.10.3","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["if-so-dynamic-content","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Run `wp plugin get if-so --field=version` or check Plugins in WP admin.\n- Versions 1.10.3 and earlier are affected; 1.10.4 is the current release and the likely fix (unconfirmed).","fix":"Update to 1.10.4 (latest on WordPress.org; its changelog lists an unspecified 'Security fix', not confirmed as this CVE). Vulnerable parameter: unknown.","status":"open","published_at":"2026-11-09T11:17:22+00:00","first_seen_at":"2026-11-09T11:26:03+00:00","triaged_at":"2026-11-09T11:26:38+00:00","updated_at":"2026-11-09T11:28:55+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-09T11:26:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"If-So Dynamic Content WordPress plugin: reflected XSS through 1.10.3","impact":"medium","summary":"The If-So Dynamic Content Personalization plugin for WordPress does not neutralize input in some pages, allowing reflected cross-site scripting. An attacker can run script in a visitor's browser by tricking them into opening a crafted link.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","if-so-dynamic-content","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker runs script in visitors' browsers on the site","analyst_note":"Find the fixed version and the vulnerable parameter from the plugin's WordPress.org changelog or the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-121782.","how_to_check":"- Check the installed version of If-So Dynamic Content Personalization in the WordPress admin under Plugins, or with `wp plugin get if-so`\n- Compare the version against `1.10.3`, which the sources name as affected up to and including that version","plain_action":"","product_name":"if-so","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the If-So Dynamic Content Personalization WordPress plugin version 1.10.3 or earlier are exposed. The sources do not say which configurations or page types are required to trigger the reflected input, so unknown. Sites that do not have the plugin installed can skip it.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000759,"input_tokens":4567,"output_tokens":605,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed version and the vulnerable parameter from the plugin's WordPress.org changelog or the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-121782.","search":"'-121782':14A,17A '-2026':13A,16A '1.10.3':11A,114C 'affect':104C 'allow':48B,100C 'attack':55B 'browser':63B 'content':5A,25B,36B,90C,95C,109C 'craft':70B 'cross':51B,81C 'cross-sit':50B,80C 'cve':12A,15A 'dynam':4A,24B,35B,89C,94C,108C 'generat':79C 'host':29B 'if':19A 'if-so':1A,18A,32B,86C,91C,97C,105C 'if-so-dynamic-cont':21B 'improp':72C 'input':44B,75C 'issu':103C 'link':71B 'n/a':112C 'neutral':43B,73C 'open':68B 'packag':26B 'page':47B,78C 'person':37B,96C,110C 'plugin':7A,38B 'reflect':8A,49B,101C 'run':57B 'script':53B,58B,83C 'self':28B 'self-host':27B 'site':52B,82C 'so':20A 'trick':65B 'visitor':61B 'vulner':84C 'web':77C 'wordpress':6A,30B,40B 'xss':9A 'xss.this':102C","nicknames":[],"mitigations":[],"who_affected":"Sites running the If-So Dynamic Content Personalization WordPress plugin version 1.10.3 or earlier are exposed. The sources do not say which configurations or page types are required to trigger the reflected input, so unknown. Sites that do not have the plugin installed can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["ifso"],"ptokens":["if","so"],"labels":["high","ifsodynamiccontent","package","selfhosted","vendor","wordpress"],"campaign_type":null,"search_a":"'-121782':14A,17A '-2026':13A,16A '1.10.3':11A 'content':5A 'cve':12A,15A 'dynam':4A 'if':19A 'if-so':1A,18A 'plugin':7A 'reflect':8A 'so':20A 'wordpress':6A 'xss':9A","search_b":"'allow':48B 'attack':55B 'browser':63B 'content':25B,36B 'craft':70B 'cross':51B 'cross-sit':50B 'dynam':24B,35B 'host':29B 'if-so':32B 'if-so-dynamic-cont':21B 'input':44B 'link':71B 'neutral':43B 'open':68B 'packag':26B 'page':47B 'person':37B 'plugin':38B 'reflect':49B 'run':57B 'script':53B,58B 'self':28B 'self-host':27B 'site':52B 'trick':65B 'visitor':61B 'wordpress':30B,40B","search_c":"'1.10.3':114C 'affect':104C 'allow':100C 'content':90C,95C,109C 'cross':81C 'cross-sit':80C 'dynam':89C,94C,108C 'generat':79C 'if-so':86C,91C,97C,105C 'improp':72C 'input':75C 'issu':103C 'n/a':112C 'neutral':73C 'page':78C 'person':96C,110C 'reflect':101C 'script':83C 'site':82C 'vulner':84C 'web':77C 'xss.this':102C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T11:17:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121782","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121782","severity":null,"published_at":"2026-11-09T11:17:22+00:00","modified_at":"2026-11-09T11:17:22+00:00","first_seen_at":"2026-11-09T11:26:03+00:00","fetched_at":"2026-11-09T11:26:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121782:2276","url":"https://wordpress.org/plugins/if-so/","severity":null,"published_at":"2026-11-09T11:28:55+00:00","modified_at":"2026-11-09T11:28:55+00:00","first_seen_at":"2026-11-09T11:28:55+00:00","fetched_at":"2026-11-09T11:28:55+00:00","note":"NVD/Patchstack: reflected XSS <= 1.10.3. WordPress.org changelog lists 1.10.4 (current) with an unnamed 'Security fix'; it does not name this CVE or the parameter, so fix is inferred, not verified. Exa credits exhausted; no Patchstack page for this CVE found.","cites":["https://wordpress.org/plugins/if-so/"]}],"documents":[{"id":107201,"url":"https://wordpress.org/plugins/if-so/","title":"If-So Dynamic Content Personalization – WordPress.org (changelog)","kind":"vendor","source":"analyst","publisher":null,"text":"Current version 1.10.4. Changelog: 1.10.4 'Security fix'; 1.10.3 'Security fixes'. No CVE id or parameter named.","published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}