¿Es seguro If So?

Qué hace este plugin

• Slug: if-so
• 7000+ instalaciones activas

conditional logicdisplay conditionselementor conditionsgeolocationvisibility control

Estado de mantenimiento

• Última versión conocida: 1.9.8
• PHP máximo soportado (analizado): 8.4

Vulnerabilidades conocidas

7 CVEs conocidos registrados para If So.

CVE-2025-58602

The If-So Dynamic Content Personalization plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2025-49875

The If-So Dynamic Content Personalization plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.9.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-10796

The If-So Dynamic Content Personalization plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.2.1 via the 'ifso-show-post' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created via Elementor that they should not have access to.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-6070

The If-So Dynamic Content Personalization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via "Geolocation License" in all versions up to, and including, 1.8.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-5713

The If-So Dynamic Content Personalization plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via '$_SERVER['REQUEST_URI']' in all versions up to, and including, 1.8.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-34820

The If-So Dynamic Content Personalization plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the edd_ifso_clear_license() function in versions up to, and including, 1.7.1. This makes it possible for unauthenticated attackers to clear licenses.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2023-51492

Update the WordPress If-So Dynamic Content Personalization plugin to the latest available version (at least 1.7). Abu Hurayra discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress If-So Dynamic Content Personalization Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 1.7. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

If-So Dynamic Content – Elementor & All Page Builders Personalization [if-so] < 1.8.0.3

The If-So Dynamic Content Personalization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ifso-redirect' shortcode in all versions up to, and including, 1.8.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Cómo solucionarlo

Mantén If So actualizado — 1.9.8 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• Conditional Fields for Contact Form 7 — 100000+ instalaciones activas — 96/100 (166) — PHP máx. 8.4
• Visibility Logic for Elementor — 30000+ instalaciones activas — 96/100 (57) — PHP máx. 8.4
• Conditional Fields for Elementor Form – Apply Conditional Logic — 10000+ instalaciones activas — 92/100 (30) — PHP máx. 8.4
• Conditional Logic Emails, Fields, Redirect for Elementor Forms — 2000+ instalaciones activas — 86/100 (11)