The affected WordPress plugin contains an improperly neutralized input flaw that allows attackers to inject arbitrary JavaScript into pages rendered by the plugin. Because the plugin reflects user‑supplied data into the output without proper encoding, a reflected XSS vulnerability exists that can lead to client‑side script execution when a malicious link or form input is processed. The impact includes theft of session cookies, defacement of user experience, or other client‑side attacks.

All installations of the WordPress If‑So Dynamic Content Personalization plugin with versions up to and including 1.10.3 are affected. The vulnerability applies to any environment where the plugin is activated, regardless of other installed WordPress components. Since the product is distributed through the WordPress repository, any WordPress site that has not yet upgraded beyond version 1.10.3 is at risk.

The CVSS score of 7.1 indicates a high severity for this XSS flaw, while the EPSS score is not publicly available and the vulnerability is not yet listed in the CISA KEV catalog. Attackers could exploit the flaw via typical reflected XSS vectors such as crafted URLs, form fields, or other input mechanisms handled by the plugin. No special privileges or network conditions are required; the vulnerability can be triggered from a remote browser context.