The Advanced iFrame plugin for WordPress is vulnerable to the creation of excessive options within the aip_map_url_callback() function in all releases up to 2024.5. Because the function does not properly restrict input, unauthenticated attackers can inject large amounts of unvalidated data into the advancediFrameParameterData option. This enables attackers to alter plugin settings at will, potentially leading to undesired behavior or further exploitation if the inserted data is used in downstream logic. The weakness stems from lack of input validation as classified by CWE-20.

WordPress sites that have the Advanced iFrame plugin installed, vendor mdempfle, product Advanced iFrame. All versions up to and including 2024.5 are affected; any installation of these versions is vulnerable regardless of WordPress core version or other plugins.

The vulnerability scores a CVSS score of 5.3, reflecting moderate severity. The EPSS score is less than 1%, indicating very low overall exploitation probability. It is not listed in the CISA KEV catalog. Attackers would need to access the remote WordPress installation and issue a request to the callback endpoint; because the manipulation is available to unauthenticated users, the likely attack vector is remote web. Given the moderate score and low exploitation likelihood, the risk to a single site is lower than high‑severity flaws, but the impact can be significant if the site relies on the plugin for critical functionality.