Vulnerabilities and security researches forif-so if-so

May 19, 2025

CVE, Research URL: CVE-2024-5440
Home page URL: Security reports for If-So Dynamic Content Personalization
Application: If-So Dynamic Content Personalization
Date: May 16, 2025
Research Description: The If-So Dynamic Content Personalization WordPress plugin before 1.8.0.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Affected versions: Min -, max -.
Status: vulnerable

Nov 23, 2024

CVE, Research URL: CVE-2024-10796
Home page URL: Security reports for If-So Dynamic Content Personalization
Application: If-So Dynamic Content Personalization
Date: Nov 21, 2024
Research Description: The If-So Dynamic Content Personalization plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.2.1 via the 'ifso-show-post' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created via Elementor that they should not have access to.
Affected versions: Min -, max -.
Status: vulnerable

Jul 14, 2024

CVE, Research URL: CVE-2024-5713
Home page URL: Security reports for If-So Dynamic Content Personalization
Application: If-So Dynamic Content Personalization
Date: Jul 13, 2024
Research Description: The If-So Dynamic Content Personalization WordPress plugin before 1.8.0.4 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
Affected versions: Min -, max -.
Status: vulnerable

CVE, Research URL: CVE-2024-6070
Home page URL: Security reports for If-So Dynamic Content Personalization
Application: If-So Dynamic Content Personalization
Date: Jul 13, 2024
Research Description: The If-So Dynamic Content Personalization WordPress plugin before 1.8.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Affected versions: Min -, max -.
Status: vulnerable

Jun 07, 2024

CVE, Research URL: CVE-2024-34820
Home page URL: Security reports for If-So Dynamic Content Personalization
Application: If-So Dynamic Content Personalization
Date: Jun 11, 2024
Research Description: Missing Authorization vulnerability in If So Plugin If-So Dynamic Content Personalization.This issue affects If-So Dynamic Content Personalization: from n/a through 1.7.1.
Affected versions: Min -, max -.
Status: vulnerable

CVE, Research URL: CVE-2023-51492
Home page URL: Security reports for If-So Dynamic Content Personalization
Application: If-So Dynamic Content Personalization
Date: Feb 10, 2024
Research Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in If So Plugin If-So Dynamic Content Personalization allows Stored XSS.This issue affects If-So Dynamic Content Personalization: from n/a through 1.6.3.1.
Affected versions: Min -, max -.
Status: vulnerable