CVE-2026-87973EPSS p1.8%

CVE-2026-87973CVE-2026-87973

Description

The If-So Dynamic Content WordPress plugin before 1.10.2 does not sanitize a conversion name before storing it, nor escape it when rendering the analytics page, allowing users with editor-level access to store JavaScript that executes in the session of a higher-privileged user who views that page.

Scoring

CVSS 3.1 ()
VectorCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N
EPSS0.12% probability of exploitation · percentile 1.8% · 2026-10-05T12:00:23Z
Last modified2026-10-01
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.