CVE-2026-118164 in If-So Dynamic Content Plugin
Summary
by MITRE • 10/28/2026
The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'repeater[*][version_uid] (and many sibling fields: freeze-mode, cookie-input, ip-input, compare, utm-value, page-url-compare, group-name, custom, …)' parameter in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified within the If-So Dynamic Content plugin for WordPress represents a significant security risk due to its potential for Stored Cross-Site Scripting attacks. This flaw exists across all versions up through 1.10.2 and stems from insufficient input sanitization and output escaping mechanisms when handling specific user-supplied parameters. The affected fields include the repeater version UID, as well as sibling inputs such as freeze mode, cookie input, IP input, comparison values, UTM value tracking, page URL comparisons, group names, and custom data entries. Because these fields are not properly validated or encoded before being stored in the database, they serve as vectors for malicious script injection that persists on the server side rather than being limited to a single session or request context.
From a technical perspective, this vulnerability aligns with CWE-79, which classifies improper neutralization of input during web page generation known as Cross-site Scripting. The core issue lies in the application's failure to apply appropriate encoding strategies when rendering user-controlled data back into HTML contexts. When an authenticated attacker injects malicious JavaScript payloads through these parameters, the scripts are saved directly within the plugin’s configuration or content structures. Consequently, every time a visitor loads a page containing this compromised dynamic content block, the browser executes the injected script in the context of the victim's session and the website's domain. This persistence distinguishes it from reflected XSS attacks, making it particularly dangerous as it does not require complex social engineering to trigger beyond initial access to the editing interface.
The operational impact of this vulnerability is severe because it allows for persistent compromise of end-users who visit affected pages. Attackers with contributor-level access or higher can exploit this flaw to steal session cookies, hijack administrative sessions if those users have elevated privileges, deface websites by altering DOM elements, or redirect traffic to malicious phishing sites. Since the payload is stored server-side, it affects all subsequent visitors regardless of their authentication status on the WordPress site. This broadens the attack surface significantly compared to non-persistent vulnerabilities and can lead to widespread data exfiltration or malware distribution depending on the sophistication of the injected script.
In terms of threat modeling, this vulnerability maps directly to MITRE ATT&CK technique T1059.007, which covers JavaScript execution within web browsers as part of client-side code injection. The attack vector typically involves an authenticated user navigating to the plugin’s configuration interface and injecting payloads into one of the vulnerable fields during content creation or modification. Once saved, the malicious code becomes part of the page structure, ensuring automatic execution upon load by any browser accessing that specific dynamic content block. This persistence mechanism allows attackers to maintain long-term access to victim sessions without needing repeated exploitation attempts for each target user.
Mitigation strategies must focus on immediate remediation and defensive coding practices. The most effective solution is to upgrade the If-So Dynamic Content plugin to a version later than 1.10.2, where developers have presumably addressed these sanitization gaps by implementing robust input validation and output encoding functions such as wp_kses or esc_html in PHP rendering contexts. For sites unable to update immediately due to compatibility constraints, temporary mitigations include restricting contributor-level access to trusted individuals only and employing Web Application Firewalls that can detect and block common XSS payload patterns in POST requests targeting these specific parameters. Additionally, implementing strict Content Security Policy headers can help mitigate the impact of any successfully injected scripts by restricting script execution sources and preventing unauthorized external resource loading.