The Advanced iFrame plugin for WordPress allows an authenticated contributor or higher user to inject arbitrary scripts into the "src" attribute of its shortcode. Because the plugin fails to properly sanitize or escape values returned from the host header, the malicious content is stored and rendered within page responses, causing the script to execute in the browsers of any user who views the affected page. This stored XSS can be used for session hijacking, phishing, or defacement, and results in a loss of confidentiality and integrity of user data.

All installations of Advanced iFrame, a WordPress plugin developed by mdempfle, with versions up to and including 2024.5 are affected. The vulnerability is present whenever the plugin’s shortcode is used in content posted by users who have contributor privileges or greater.

The Common Vulnerability Scoring System score of 6.4 indicates a moderate severity. The EPSS score of less than 1 % suggests a low probability of exploitation at this time, and the vulnerability is not currently listed in the CISA KEV catalog. The attack requires the attacker to be authenticated with contributor-level access or higher and to supply a malicious host header that is reflected in the src attribute. Because the flaw is stored, the malicious script persists in the stored post content and will be delivered automatically to any visitor of that page, making the attack practical when the plugin is actively in use.