# CVE-2026-87971: If-So Dynamic Content WordPress plugin reflected XSS

Source: https://junglewise.ai/threats/cve-2026-87971-the-if-so-dynamic-content-wordpress-plugin-before-1-10-2-does-not  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-07. Updated: 2026-10-07  
License: CC BY 4.0 with a link back

CVE-2026-87971 · Severity: info · Published 2026-10-07

The If-So Dynamic Content WordPress plugin contains a reflected cross-site scripting (XSS) vulnerability in versions before 1.10.2 that allows attackers to execute arbitrary JavaScript in the browser of a logged-in administrator. An attacker can craft a malicious link that, when clicked by an admin user, injects and runs malicious code with the admin's privileges, potentially leading to account compromise or unauthorized site modifications.

Vendors: [If-So](https://junglewise.ai/threats/vendors/if-so).

## Quick answers

**Is CVE-2026-87971 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-87971 being exploited in the wild.

**How severe is CVE-2026-87971?** Informational severity, published 7 October 2026.

**Which products and versions are affected?** If-So Dynamic Content 1.4.4 through 1.10.1.

**Is there a fix for CVE-2026-87971?** Yes: fixed in 1.10.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-87971 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-87971?** Check whether you run If-So Dynamic Content at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.10.2

## Technical details

The vulnerability is a reflected XSS flaw in the 'message' parameter that fails to validate URL schemes before reflecting the value into a link on an admin page. The attack requires a logged-in WordPress administrator to click a crafted link, and successful exploitation allows arbitrary JavaScript execution in the admin's browser context.

## Affected products

- If-So Dynamic Content 1.4.4 through 1.10.1

## Timeline

- 2026-10-05: disclosed
- 2026-10-07: advisory

## References

- [https://wpscan.com/vulnerability/f03cb198-7d64-4405-9c2c-5342f24deb4f/](https://wpscan.com/vulnerability/f03cb198-7d64-4405-9c2c-5342f24deb4f/)

## Related threats

- [If-So Dynamic Content WordPress plugin reflected XSS via AJAX](https://junglewise.ai/threats/cve-2026-87970-the-if-so-dynamic-content-wordpress-plugin-before-1-10-2-does-not)