CVE-2025-1439: Improper Neutralization of Input During Web Page Generation

The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advancediframe' shortcode in all versions up to, and including, 2024.5 due to insufficient input sanitization and output escaping on user supplied attributes through the 'src' attribute when th...

CVE-2025-1440: Improper Input Validation

The Advanced iFrame plugin for WordPress is vulnerable to unauthorized excessive creation of options on the aipmapurlcallback function in all versions up to, and including, 2024.5 due to insufficient restrictions. This makes it possible for unauthenticated attackers to update the...

CVE-2025-1437: Improper Neutralization of Input During Web Page Generation

The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advancediframe' shortcode in all versions up to, and including, 2025.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-11335: Improper Neutralization of Input During Web Page Generation

The UltraEmbed – Advanced Iframe Plugin For WordPress with Gutenberg Block Included plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'iframe' shortcode in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping on user...

CVE-2023-6844: Improper Neutralization of Input During Web Page Generation

The iframe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to and including 5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

PT-2024-15108

Name of the Vulnerable Software and Affected Versions iframe plugin for WordPress versions up to and including 5.0 Description The issue is related to Stored Cross-Site Scripting via the plugin's shortcodes due to insufficient input sanitization and output escaping on user-supplied attributes. Th...

CVE-2023-4775: Improper Neutralization of Input During Web Page Generation

The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'advancediframe' shortcode in versions up to, and including, 2023.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

PT-2023-30587

Name of the Vulnerable Software and Affected Versions Advanced iFrame plugin for WordPress versions up to, and including, 2023.8 Description The issue is related to Stored Cross-Site Scripting via the 'advanced iframe' shortcode due to insufficient input sanitization and output escaping on...

CVE-2023-4919: Improper Neutralization of Input During Web Page Generation

The iframe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the iframe shortcode in versions up to, and including, 4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permission and above, ...

PT-2023-31107

Name of the Vulnerable Software and Affected Versions iframe plugin for WordPress versions up to, and including, 4.6 Description The issue is related to Stored Cross-Site Scripting via the iframe shortcode due to insufficient input sanitization and output escaping. This allows authenticated...