This stored XSS flaw allows an attacker to inject malicious JavaScript into the content managed by the iFrame Block plugin. When that content is displayed in a browser, the script runs in the context of the site, potentially leaking session data, defacing the site, or redirecting users. The weakness is a type of input validation failure (CWE‑79) that can affect the confidentiality, integrity, and availability of the site.

The vulnerability impacts the iFrame Block plugin by Vikas Sharma for WordPress, any version from the first release through version 0.1.1. Users running the plugin on any WordPress installation are affected if the plugin has not been updated beyond 0.1.1.

The CVSS score of 7.1 indicates a high impact, while the EPSS score of less than 1 % suggests the likelihood of exploitation is currently low. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need to supply malicious content to the plugin through an input field, so the attack vector is likely local or requires an authenticated editor or administrator. No additional exploitation conditions are indicated in the published data.