CVE-2025-1439

CVE-2025-1439 — The WordPress plugin Advanced iFrame is vulnerable to a Stored Cross-Site Scripting (XSS) condition through the host header and the plugin’s advanced_iframe/src attributes in versions up to and including 2024.5. Exploitation requires authentication at contributor level or higher, ...

CVE-2021-24953

Summary: CVE-2021-24953 affects the WordPress plugin “Advanced iFrame” (versions before 2022). The vulnerability stems from insufficient sanitisation/escaping of the ai_config_id parameter when it is echoed back on an admin page, enabling a Reflected Cross-Site Scripting (XSS) attack. The issue i...

CVE-2025-1437

CVE-2025-1437 affects the WordPress plugin Advanced iFrame . The vulnerability is a Stored Cross-Site Scripting (XSS) via the plugin’s advanced_iframe shortcode in all versions up to 2025.2, caused by insufficient input sanitization and output escaping on user-supplied attributes. Impact: authent...

CVE-2024-24870

The CVE-2024-24870 entry describes a Stored XSS in the WordPress Advanced iFrame plugin (≤ 2023.10) due to Improper Neutralization of Input During Web Page Generation. Affected component: Advanced iFrame plugin; root cause: insufficient input sanitization/escaping in the advanced_iframe context. ...

CVE-2023-7069

The CVE concerns the WordPress plugin Advanced iFrame (<= 2023.10). The vulnerability is a Stored Cross-Site Scripting (XSS) caused by improper input sanitization and output escaping in the plugin’s advanced_iframe shortcode, enabling authenticated contributors (or higher) to inject scripts on...

CVE-2023-51690

CVE-2023-51690 affects the WordPress WordPress Advanced iFrame plugin. The vulnerability is an Improper Neutralization of Input During Web Page Generation, i.e., a Stored Cross-Site Scripting (XSS) issue in the plugin’s input handling. Affected versions are

CVE-2023-4775

CVE-2023-4775 affects the WordPress plugin Advanced iFrame. The vulnerability is a stored XSS in the plugin’s shortcode [advanced_iframe], caused by insufficient input sanitization and output escaping of user-supplied attributes. It requires authenticated access (contributor level or higher) and ...