---
id: CVE-2026-118164
title: >-
  If-So Dynamic Content <= 1.10.2 - Authenticated (Contributor+) Stored
  Cross-Site Scripting via 'repeater' Parameter
summary: >-
  The If-So Dynamic Content – Elementor & All Page Builders Personalization
  plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the
  'repeater[*][version_uid] (and many sibling fields: freeze-mode, cookie-input,
  ip-input, …
severity: medium
cvss: 6.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: ifso
product: If-So Dynamic Content – Elementor & All Page Builders Personalization
affected:
  - if-so_dynamic_content_elementor_all_page_builders_personalization <= 1.10.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-28T14:36:14.082990Z'
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T16:09:59.980Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-118164'
references:
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/5df83f52-b976-4f60-b48d-d76b1ce2af9f?source=cve
  - url: >-
      https://plugins.trac.wordpress.org/browser/if-so/tags/1.10.2/admin/partials/ifso_trigger_settings_metabox.php#L392
  - url: >-
      https://plugins.trac.wordpress.org/browser/if-so/tags/1.10.2/admin/class-if-so-settings.php#L726
  - url: >-
      https://plugins.trac.wordpress.org/browser/if-so/tags/1.10.2/admin/class-if-so-settings.php#L747
  - url: >-
      https://plugins.trac.wordpress.org/browser/if-so/tags/1.10.2/admin/partials/ifso_trigger_settings_metabox.php#L356
  - url: >-
      https://plugins.trac.wordpress.org/browser/if-so/tags/1.10.2/admin/partials/ifso_trigger_settings_metabox.php#L371
  - url: >-
      https://plugins.trac.wordpress.org/browser/if-so/tags/1.10.2/admin/class-if-so-admin.php#L104
  - url: >-
      https://plugins.trac.wordpress.org/changeset/3748902/if-so/trunk/admin/partials/ifso_trigger_settings_metabox.php
tags:
  - cve.org
epss: 0.00206
epssPercentile: 0.10661
ingestedAt: '2026-10-28T07:06:27.117Z'
---

## Overview

The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'repeater[*][version_uid] (and many sibling fields: freeze-mode, cookie-input, ip-input, compare, utm-value, page-url-compare, group-name, custom, …)' parameter in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

## Affected

- `if-so_dynamic_content_elementor_all_page_builders_personalization <= 1.10.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.