Executive brief
Advanced iFrame, a WordPress plugin used to embed external content into websites, contains a security flaw that allows users with contributor-level access or higher to inject malicious scripts. These scripts are stored on the website and will automatically run in the browser of any visitor who views the affected page. This could lead to unauthorized actions being performed on behalf of site visitors or administrators, potentially compromising user sessions or site integrity.
Technical details
The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'additional' parameter. This vulnerability allows authenticated attackers with contributor-level permissions or higher to inject arbitrary web scripts into pages. Because the scripts are stored in the database, they execute in the context of a user's browser whenever they visit the compromised page. The attack vector is network-based and requires low privileges, but does not require user interaction to trigger once the script is injected. A patch appears to be available in the plugin's changeset 3558422.
Affected products
- mdempfle Advanced iFrame up to, and including, 2026.1
Timeline
- 2026-07-08: disclosed
- 2026-07-08: advisory