{"id":"CVE-2026-87970","published":"2026-10-01T06:17:12.840","lastModified":"2026-10-01T13:11:52.923","description":"The If-So Dynamic Content  WordPress plugin before 1.10.2 does not escape a request-supplied value before reflecting it in an unauthenticated AJAX response that is served as HTML, allowing attackers to execute arbitrary JavaScript in the browser of a visitor who opens a crafted link.","cvssScore":4.7,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/a0ae7165-0d5b-4f81-b35b-2d9076573530/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}