The If‑So Dynamic Content plugin allows contributors to attach arbitrary scripts via the 'conversion' shortcode. Because the input is not sanitized and the output is not escaped, an attacker with contributor privileges can place malicious JavaScript that executes for any visitor accessing the page. This gives the attacker the ability to deface, steal credentials, or redirect users. The weakness corresponds to CWE‑79.

Users of If‑So Dynamic Content – Elementor & All Page Builders Personalization for WordPress, versions 1.10.2 and earlier, are affected. The flaw exists on all WordPress installations that include this plugin.

The CVSS score of 6.4 indicates moderate severity. The vulnerability requires authentication as a contributor or higher and relies on a user’s browser to execute the injected script. No known public exploits are recorded and the EPSS score is not available, which suggests low to moderate exploitation probability. The plugin is not listed in the CISA KEV catalog.