CVE-2024-1341

CVE-2024-1341 describes a Stored XSS in Advanced iFrame for WordPress (all versions up to 2024.1) via the advanced_iframe shortcode. The vulnerability arises because the plugin allows JS files from external sources through the additional_js attribute, enabling authenticated attackers with contrib...

CVE-2025-1440

CVE-2025-1440 concerns the WordPress plugin Advanced iFrame. The Red Hat entry confirms the issue: in all versions up to 2024.5, the aip_map_url_callback() function has insufficient restrictions, enabling unauthorized creation of options. This allows unauthenticated attackers to update the advanc...