CVE-2023-4919 iframe <= 4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'iframe' Shortcode

The iframe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the iframe shortcode in versions up to, and including, 4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permission and above, ...

CVE-2023-4919

The provided sources confirm CVE-2023-4919: the WordPress iframe plugin is vulnerable to Stored XSS via the iframe shortcode in versions up to and including 4.6 due to insufficient input sanitization and output escaping. Attack requires contributor-level privileges or higher and affects pages ren...