Advanced iFrame <= 2025.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

July 26, 2025 invoker category_cve

CVE Details

Basic Information

Title Advanced iFrame <= 2025.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Type cve
Published 2025-07-26T06:43:21.917Z
Modified 2025-07-26T06:43:21.917Z

Product Information

Vendor mdempfle
Product Advanced iFrame
Version *

CVSS Information

Base Score 6.4 (MEDIUM)
Attack Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

AI Analysis

AI Description The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization in the ‘advanced_iframe’ shortcode. This allows authenticated attackers with contributor-level access to inject arbitrary scripts that execute when users access the affected pages.
AI Severity Medium
AI Vendor WordPress Community
AI Product Advanced iFrame
AI Version up to 2025.5

Affected Products

  • mdempfle Advanced iFrame *

Additional Information

CWE List CWE-79
Source Wordfence

Description

The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘advanced_iframe’ shortcode in all versions up to, and including, 2025.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

💭 Join the Security Discussion

🔒 Your email address will not be published. Required fields are marked *

⚠️ Please be respectful and constructive in your comments. Security discussions should remain professional.