Unknown If-So Dynamic Content vulnerabilities

3 CVEs affecting Unknown If-So Dynamic Content, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-87971, published 2026-10-07.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-87970, published 2026-10-01. Medium severity, CVSS 4.7. EPSS: 0.2% chance of exploitation in the next 30 days. The If-So Dynamic Content WordPress plugin before 1.10.2 does not escape a request-supplied value before reflecting it in an unauthenticated AJAX response that is served as HTML, allowing attackers…
CVE-2026-87971, published 2026-10-07. High severity, CVSS 7.1. EPSS: 0.1% chance of exploitation in the next 30 days. The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin page, allowing attackers to execute…
CVE-2026-87973, published 2026-10-01. Low severity, CVSS 3.1. EPSS: 0.1% chance of exploitation in the next 30 days. The If-So Dynamic Content WordPress plugin before 1.10.2 does not sanitize a conversion name before storing it, nor escape it when rendering the analytics page, allowing users with editor-level…