An unsafe handling of user input in the Advanced iFrame plugin leads to a DOM-based cross‑site scripting flaw. The flaw permits injection of arbitrary JavaScript into a victim’s browser context, potentially enabling credential theft, session hijacking or malicious content injection. The weakness is classified as a classic input validation issue, CWE‑79.

All releases of mdempfle's Advanced iFrame plugin from the initial release through version 2025.10 contain the vulnerability and should be considered vulnerable.

The CVSS base score is 6.5, indicating moderate severity, and the EPSS score is below 1 %, signifying a low current exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog, and no verified public exploit is disclosed. The attack vector would typically involve a maliciously crafted URL or user-supplied iframe parameters that a user inadvertently visits or interacts with.