Description
The If-So Dynamic Content Personalization WordPress plugin before 1.8.0.4 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | If-So Dynamic Content Personalization | < 1.8.0.4 | 1.8.0.4 |
References
- https://wpscan.com/vulnerability/eb3f24a7-3171-42c3-9016-e29da4f384fa/ exploit vdb-entry technical-description