MEDIUM 4.7 NVD

CVE-2026-87970

The If-So Dynamic Content WordPress plugin before 1.10.2 does not escape a request-supplied value before reflecting it in an unauthenticated AJAX response that

The If-So Dynamic Content WordPress plugin before 1.10.2 does not escape a request-supplied value before reflecting it in an unauthenticated AJAX response that is served as HTML, allowing attackers to execute arbitrary JavaScript in the browser of a visitor who opens a crafted link.

References

https://wpscan.com/vulnerability/a0ae7165-0d5b-4f81-b35b-2d9076573530/

Published: 2026-10-01 · Source: NVD · Feed updated: 2026-10-01

This medium severity vulnerability with a CVSS score of 4.7 was published on 2026-10-01 via NVD.

vulnfeed aggregates 12641 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.