The Advanced iFrame WordPress plugin allows users to embed content via a shortcode. Because insufficient input sanitization and output escaping were implemented, an attacker with contributor-level access can inject arbitrary JavaScript into the shortcode attributes. The victim’s browser executes the script when the page containing the shortcode is viewed, enabling session hijacking, defacement, or other client‑side attacks. This flaw is categorized as a classic input validation weakness (CWE‑79).

The vulnerability affects the Advanced iFrame plugin for WordPress distributed by mdempfle. All released versions up to and including 2025.2 are affected; later releases (2025.3 and onward) include the fix.

The CVSS score of 6.4 indicates a moderate severity. The EPSS score of less than 1% suggests exploitation is unlikely in the short term, and the flaw is not listed in CISA’s KEV catalog. The attack requires authenticated access of contributor role or higher, likely via the WordPress admin interface where the attacker can edit or insert content containing the malicious shortcode. Once stored, the payload auto‑executes for any user who views the affected page.