The If‑So Dynamic Content plugin is vulnerable to a stored Cross‑Site Scripting flaw, where the 'url' attribute in the ifso-redirect shortcode is not properly sanitized or escaped. An authenticated user with contributor-level privilege can inject arbitrary JavaScript that will run whenever an administrator preview or opens the post containing the crafted shortcode, allowing the attacker to hijack the admin session or manipulate the page in the browser. This flaw is classified as CWE‑79.

The vulnerability affects all installations of the If‑So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress running version 1.10.2 or earlier. WordPress sites that use this plugin and grant contributor or higher role permissions to users are impacted.

The CVSS score of 6.4 indicates a moderate severity. The attack requires authenticated access and the injection must be performed via a short‑code that triggers only in an admin preview context, limiting the exposure window and reducing the likelihood of widespread exploitation. No EPSS data is available and the flaw is not currently listed in the CISA KEV catalog. The risk is moderate, primarily affecting sites with contributor users enabled and those that rely on the ifso-redirect shortcode extensively.