Unvalidated URL Scheme Reflects JavaScript in WordPress Admin

The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin page, allowing attackers to execute arbitrary JavaScript in the browser of a logged-in user who opens a crafted link.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The If-So Dynamic Content WordPress plugin before version 1.10.2 contains a reflected cross-site scripting (XSS) vulnerability stemming from insufficient URL scheme validation. When the plugin reflects user-supplied URL parameters into admin page links without proper sanitization, attackers can inject malicious JavaScript payloads by crafting URLs with non-HTTP schemes (such as `javascript:` or `data:`). This vulnerability is particularly dangerous because it targets authenticated WordPress administrators—users who typically have elevated privileges. Any logged-in admin who clicks a weaponized link will execute arbitrary JavaScript in their browser context, potentially leading to account takeover, plugin installation, or unauthorized configuration changes that compromise the entire WordPress installation.

Casky's 323 mapped skills leverage Claude's extended reasoning to detect this attack pattern across MITRE ATT&CK techniques TA0001 (Reconnaissance) and TA0043 (Reconnaissance). Practitioners using Casky would observe findings highlighting URL-based injection attempts, parameter tampering indicators, and DOM-based XSS signatures. The platform's skill mapping would flag suspicious request patterns where unvalidated scheme parameters flow directly into rendered HTML attributes—specifically detecting when admin referrer URLs, redirect parameters, or dynamic content links bypass validation controls. Security teams would see detailed analysis of how attackers craft initial access reconnaissance through social engineering (phishing with malicious links) and subsequent execution flows, enabling them to identify similar validation gaps across their WordPress plugin ecosystem before exploitation occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-87971.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-87971

Casky has 323 skills that investigate the attack patterns behind CVE-2026-87971. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn