{"id":"CVE-2026-87971","aliases":["EUVD-2026-94188","GHSA-qp9g-v8qg-cx5q"],"status":"published","title":"If-So Dynamic Content 1.4.4 - 1.10.1 - Reflected XSS via 'message' Parameter","description":"The If-So Dynamic Content  WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin page, allowing attackers to execute arbitrary JavaScript in the browser of a logged-in user who opens a crafted link.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00142,"percentile":0.03558,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-10-07T06:00:08Z","modified":"2026-10-07T14:52:43Z","products":[{"vendor":"unknown","product":"if-so dynamic content"}],"references":[{"url":"https://wpscan.com/vulnerability/f03cb198-7d64-4405-9c2c-5342f24deb4f/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87971"},{"url":"https://wpscan.com/vulnerability/f03cb198-7d64-4405-9c2c-5342f24deb4f"},{"url":"https://github.com/advisories/GHSA-qp9g-v8qg-cx5q"}],"sources":{"cve":[{"id":"CVE-2026-87971","title":"If-So Dynamic Content 1.4.4 - 1.10.1 - Reflected XSS via 'message' Parameter","description":"The If-So Dynamic Content  WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin page, allowing attackers to execute arbitrary JavaScript in the browser of a logged-in user who opens a crafted link.","status":"published","published":"2026-10-07T06:00:08.472Z","modified":"2026-10-07T09:57:40.378Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T13:37:58.613221Z"}],"euvd":[{"id":"EUVD-2026-94188","description":"The If-So Dynamic Content  WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin page, allowing attackers to execute arbitrary JavaScript in the browser of a logged-in user who opens a crafted link.","status":"published","published":"2026-10-07T06:00:08Z","modified":"2026-10-07T09:57:40Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T17:27:35.926265Z"}],"ghsa":[{"id":"GHSA-qp9g-v8qg-cx5q","title":"The If-So Dynamic Content  WordPress plugin before 1.10.2 does not validate the URL scheme of a...","description":"The If-So Dynamic Content  WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin page, allowing attackers to execute arbitrary JavaScript in the browser of a logged-in user who opens a crafted link.","status":"published","published":"2026-10-07T09:32:20Z","modified":"2026-10-07T12:31:58Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:12:54.084372Z"}],"nvd":[{"id":"CVE-2026-87971","description":"The If-So Dynamic Content  WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin page, allowing attackers to execute arbitrary JavaScript in the browser of a logged-in user who opens a crafted link.","status":"published","published":"2026-10-07T07:17:01.95Z","modified":"2026-10-07T14:52:43.42Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:54.809359Z"}]}}