Improper Neutralization of Input During Web Page Generation, also known as Cross‑Site Scripting, exists in the If‑So Dynamic Content Personalization plugin for WordPress. The flaw allows an attacker to inject malicious scripts that are reflected in generated web pages, enabling actions such as stealing credentials, defacing content, or executing client‑side commands. The issue is a classic input‑validation weakness (CWE‑79) and requires no special privileges or authentication to exploit the vulnerable plugin. Attackers can trigger the payload simply by visiting a crafted URL or triggering a plugin‑controlled element on the site.

The vulnerability affects installations of the If‑So Dynamic Content Personalization plugin for WordPress, specifically all versions up to 1.10.1. No specific operating system or WordPress core version is mentioned, but any WordPress site that has this plugin installed and has not upgraded is susceptible.

The CVSS score of 7.1 classifies this as high severity. The EPSS score of 0.0018 indicates a very low probability of exploitation, but the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is an unauthenticated web request to a page served by the vulnerable plugin, meaning any visitor can trigger the XSS. Because no authentication or privileged context is required, the risk to exposed sites remains significant, especially for those with managed or shared hosting environments where many users may inadvertently trigger the flaw.