CVE-2024-10151

CVE-2024-10151 concerns the Auto iFrame WordPress plugin (before 2.0). It allows Stored XSS via unvalidated shortcode attributes output in posts when the shortcode is embedded. Affected users must have Contributor+ rights; impact is limited to stored XSS on pages using the shortcode. Connected Re...

PT-2025-1578 · WordPress · Auto Iframe

Name of the Vulnerable Software and Affected Versions: Auto iFrame WordPress plugin versions prior to 2.0 Description: The issue concerns the Auto iFrame WordPress plugin, where versions prior to 2.0 do not validate and escape some of its shortcode attributes before outputting them back in a page...

WordPress plugin Auto iFrame 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2025-22545

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in sw.galati iframe to embed iframe-to-embed allows Stored XSS.This issue affects iframe to embed: from n/a through = 1.2...

CVE-2025-22545

CVE-2025-22545: The iframe-to-embed vulnerability (sw-galati.ro iframe) allows Stored XSS when embedding the iframe. Affected: iframe-to-embed. Root cause: improper input neutralization during web page generation. Impact per provided metrics is Low in confidentiality, integrity, availability with...

CVE-2025-22545 WordPress iframe to embed plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in sw.galati iframe to embed iframe-to-embed allows Stored XSS.This issue affects iframe to embed: from n/a through = 1.2...

CVE-2025-22545 WordPress iframe to embed plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in sw-galati.ro iframe to embed allows Stored XSS.This issue affects iframe to embed: from n/a through 1.2...

WordPress iframe to embed plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin iframe to embed versions = 1.2...

PT-2025-4536 · Unknown · Sw-Galati.Ro

Name of the Vulnerable Software and Affected Versions: sw-galati.ro iframe to embed versions n/a through 1.2 Description: The issue is related to improper neutralization of input during web page generation, also known as Cross-site Scripting. This allows for Stored XSS in the iframe to embed...

WordPress plugin iframe to embed 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripti...

CVE-2024-55896

IBM PowerHA SystemMirror for i 7.4 and 7.5 contains improper restrictions when rendering content via iFrames. This vulnerability could allow an attacker to gain improper access and perform unauthorized actions on the system...

CVE-2024-55896

IBM PowerHA SystemMirror for i 7.4 and 7.5 contains improper restrictions when rendering content via iFrames. This vulnerability could allow an attacker to gain improper access and perform unauthorized actions on the system...

IBM PowerHA SystemMirror 安全漏洞

IBM PowerHA SystemMirror is a high-availability cluster multiprocessor program from International Business Machines IBM. A security vulnerability exists in IBM PowerHA SystemMirror for i versions 7.4 and 7.5 that stems from the inclusion of improper restrictions when rendering content via iFrames...

PT-2024-36606 · Ibm · Ibm Powerha Systemmirror

Name of the Vulnerable Software and Affected Versions: IBM PowerHA SystemMirror for i versions 7.4 through 7.5 Description: The issue is related to improper restrictions when rendering content via iFrames, which could allow an attacker to gain improper access and perform unauthorized actions on t...

GHSA-M3R7-8GW7-QWVC thorsten/phpmyfaq Unintended File Download Triggered by Embedded Frames

Summary A vulnerability exists in the FAQ Record component where a privileged attacker can trigger a file download on a victim's machine upon page visit by embedding it in an element without user interaction or explicit consent. Details In...

User Interface (UI) Misrepresentation of Critical Information

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to User Interface UI Misrepresentation of Critical Information via the FAQ Record component. An attacker can trigger a file download on a victim's machine...

CVE-2024-55889

phpMyFAQ is an open source FAQ web application. Prior to version 3.2.10, a vulnerability exists in the FAQ Record component where a privileged attacker can trigger a file download on a victim's machine upon page visit by embedding it in an element without user interaction or explicit consent...

CVE-2024-55889

CVE-2024-55889 affects the phpMyFAQ open source FAQ web application. The issue is in the FAQ Record component prior to version 3.2.10, where a privileged attacker can trigger a file download on a victim’s machine by embedding the target file in an iframe upon visiting a page, without user interac...

CVE-2024-55889 phpMyFAQ Vulnerable to Unintended File Download Triggered by Embedded Frames

phpMyFAQ is an open source FAQ web application. Prior to version 3.2.10, a vulnerability exists in the FAQ Record component where a privileged attacker can trigger a file download on a victim's machine upon page visit by embedding it in an element without user interaction or explicit consent...

CVE-2024-55889 phpMyFAQ Vulnerable to Unintended File Download Triggered by Embedded Frames

phpMyFAQ is an open source FAQ web application. Prior to version 3.2.10, a vulnerability exists in the FAQ Record component where a privileged attacker can trigger a file download on a victim's machine upon page visit by embedding it in an element without user interaction or explicit consent...