The Advanced iFrame WordPress plugin is vulnerable to stored cross‑site scripting through the 'additional' parameter in versions 2025.6 or earlier due to insufficient input sanitization and output escaping. A compromised value is persisted in the database, meaning any user who views the affected page will execute the injected script. This can be used to hijack sessions, deface content, or redirect users to malicious sites.

The affected product is the Advanced iFrame plugin by mdempfle, versions 2025.6 and below. Users with contributor level or higher access in a WordPress installation can trigger the vulnerability by inputting content through the admin interface.

The CVSS score of 5.4 indicates a moderate severity, while the EPSS score of < 1% suggests exploitation is currently considered unlikely. The vulnerability requires authenticated access, so an attacker must first obtain contributor credentials; this limits the attack surface relative to a purely remote exploitation. The vulnerability is not listed in CISA’s KEV catalog, further indicating low immediate exploitation activity. Nonetheless, any authenticated user with contributor privileges could inject arbitrary scripts, posing a noticeable risk to site visitors.