CVE-2026-103996 in Dynamic Content Plugin
Summary
by MITRE • 10/28/2026
The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' parameter in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected script executes specifically in the administrator's browser session, as the vulnerable branch only renders when an administrator previews or opens the post containing the crafted shortcode.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The If-So Dynamic Content plugin for WordPress represents a significant attack surface due to its widespread adoption among developers and site administrators seeking dynamic personalization capabilities. The vulnerability identified in versions up through 1.10.2 stems from insufficient input sanitization and output escaping mechanisms within the plugin's handling of the url parameter. This architectural flaw allows authenticated attackers possessing contributor-level access or higher to inject arbitrary web scripts into pages managed by the platform. Unlike reflected cross-site scripting where execution is immediate upon request, this stored variant persists in the database, ensuring that every time a specific page containing the crafted shortcode is accessed under certain conditions, the malicious payload is delivered and executed within the victim's browser session.
The operational impact of this vulnerability is particularly severe because it targets administrative functions through a privilege escalation vector inherent to WordPress role hierarchies. Although an attacker may only hold contributor-level permissions initially, they can manipulate content that triggers execution specifically when an administrator previews or opens the post containing the malicious shortcode. This dynamic ensures that the injected script runs with the full privileges of the administrator's browser session rather than those of the low-privileged attacker. Consequently, this enables a wide range of destructive actions including session hijacking, credential theft via keyloggers, defacement of the administrative interface, or further propagation of malware to other users who visit the compromised page. The reliance on preview functionality creates a unique trigger condition that bypasses standard content review workflows since administrators often trust their own previews implicitly.
From a classification perspective, this vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-Site Scripting. Specifically it falls under the stored variant where malicious code is permanently stored within target systems such as databases or comment fields. In terms of offensive security frameworks like MITRE ATT&CK for Enterprise this behavior maps to techniques involving client-side injection and potentially credential harvesting through browser-based attacks. The exploitation chain relies heavily on social engineering elements since the attacker must convince an administrator with sufficient privileges to view the specific post containing the embedded malicious shortcode effectively turning a legitimate administrative action into a vector for compromise.
Mitigation strategies should prioritize immediate patching of all affected installations to version 1.10.3 or later where these sanitization and escaping issues have been addressed by the developers. For organizations unable to update immediately due to compatibility concerns with other plugins, implementing Web Application Firewall rules that detect and block script injection patterns in post content can provide a temporary layer of defense. Additionally enforcing strict Content Security Policy headers across all WordPress sites helps mitigate the impact of successful XSS attacks by restricting the sources from which scripts can be loaded or executed. Regular auditing of user roles is also recommended to ensure that only trusted individuals with contributor-level access and above are permitted to create or edit content, thereby reducing the pool of potential attackers capable of injecting malicious shortcodes into the system.