CVE-2026-118164

MediumCVSS 6.4/10Last modified Oct 28, 2026

Description

The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'repeater[*][version_uid] (and many sibling fields: freeze-mode, cookie-input, ip-input, compare, utm-value, page-url-compare, group-name, custom, …)' parameter in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
ifso	If-So Dynamic Content – Elementor & All Page Builders Personalization	<= 1.10.2

References

Timeline

Published: Oct 28, 2026
Last modified: Oct 28, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1181656.8The Firelight Lightbox WordPress plugin before 2.3.23 does not escape the URL of links it opens in its Classic lightbox before inserting it CVE-2026-1181664.8The MC4WP: Mailchimp for WordPress WordPress plugin before 4.15.0 does not prevent request-derived values in its dynamic content tags from b CVE-2026-1181675.3The MC4WP: Mailchimp for WordPress plugin before 4.15.0 does not validate that the Mailchimp audience a sign-up form or bundled integration CVE-2026-1181685.3The MapPress WordPress plugin before 2.97.15 does not restrict which user's data its front-end map embed handler renders, allowing unauthen CVE-2026-1181694.9The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'con CVE-2026-118175.3This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In CVE-2026-1181709.1The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying whe CVE-2026-1181716.5The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint. This allows low-privi CVE-2026-1181726.1The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-blind SSRF via a webhook follow-redirect. The webhook dispat CVE-2026-1181736.1MISP Guard, a proxy that enforces security policies on MISP feed data, contained an incomplete validation check for required taxonomy tags. CVE-2026-1181746.5When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's content to offer import CVE-2026-1181757.5When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different message stored in the