The Advanced iFrame plugin for WordPress is vulnerable to stored cross‑site scripting because the 'additional' attribute of Gutenberg blocks is not sanitized or escaped. An authenticated user with contributor or higher privileges can inject arbitrary web scripts into this attribute. The plugin saves the raw attribute value, so when a page containing the block is rendered the script executes in the visitor’s browser, allowing the attacker to run client‑side code on every page that loads the block.

All releases of the Advanced iFrame plugin from developer mdempfle up through version 2026.1 are affected. WordPress sites that have installed one of these versions and allow contributor-level users to modify Gutenberg blocks can be vulnerable.

The CVSS score of 6.4 indicates moderate severity, and the EPSS score of less than 1 % suggests a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. An attacker with contributor privileges can create or edit a Gutenberg block containing the 'additional' attribute; once the malicious payload is stored, it executes for any visitor who loads the affected page. Impact remains significant for sites that permit such contributors.