The Advanced iFrame plugin for WordPress contains a stored cross‑site scripting flaw in the 'advanced_iframe' shortcode: the plugin fails to properly sanitize or escape user‑supplied attributes. An authenticated user with contributor or higher privileges can inject arbitrary JavaScript payloads into a page title or description, and that payload is stored in the database and subsequently rendered whenever any visitor opens the page. The injected script executes in the visitor’s browser, potentially allowing an attacker to steal session cookies, deface content, or load additional malicious resources. The effect is that a single malicious contributor can compromise the browsers of any user who views the affected page.

All WordPress sites that have installed mdempfle’s Advanced iFrame plugin with a version no newer than 2025.5 are vulnerable. The flaw resides in the rendering of the shortcode, so any site that uses this shortcode—regardless of theme or other plugins—is impacted.

The CVSS score of 6.4 indicates moderate severity. The EPSS score of less than 1% suggests that exploitation attempts are currently rare. The vulnerability is not listed in the CISA KEV catalog, meaning there are no confirmed large‑scale exploit campaigns at this time. Attack requires that the user be authenticated with at least contributor privileges, narrowing the attacker pool to users who have been granted editing access. Based on the description, the likely attack vector is the execution of injected scripts in ordinary users’ browsers when they view an affected page; this inference follows from the stored‑content nature of the flaw.