The If‑So Dynamic Content WordPress plugin, prior to version 1.10.2, fails to sanitize the conversion name field before storing it and fails to escape the value when rendering the analytics page. An editor‑level user can therefore embed arbitrary JavaScript in a conversion name that is stored, which executes in the browser session of any higher‑privileged user who views that analytics page. This stored cross‑site scripting flaw permits in‑browser code execution with the privileges of the page viewer, potentially enabling session hijacking, defacement, or credential theft.

WordPress plugin "If‑So Dynamic Content", versions 1.9.9 through 1.10.1.

The CVSS score of 3.1 indicates low severity, but the flaw remains vulnerable to users with editor permissions who can create or modify conversion names. Once malicious JavaScript is stored, it executes when a higher‑privileged user such as an administrator views the analytics page, running in the context of that user’s session. No EPSS is available, and the vulnerability is not listed in the CISA KEV catalog. The impact is a potential compromise of higher‑privileged accounts when they visit the affected page; the attack vector is inferred to be the conversion name input exposed to editor users.