Skip to content
Noroxi

Advanced iFrame

advanced-iframe · plugin

Known security vulnerabilities for Advanced iFrame. Find out in seconds which version runs on your site with WP Lens.

14 known vulnerabilities

1 exploitable without logging in · latest Jul 8, 2026

Listed on wordpress.org · latest 2026.3 · last updated Sep 23, 2026 · 40K+ installs

wordpress.org status checked on Oct 2, 2026

Vulnerabilities

  • CVE-2026-25453login required≤ 2025.10

    WordPress Advanced iFrame plugin <= 2025.10 - Cross Site Scripting (XSS) vulnerability

    Medium 6.5

  • CVE-2024-32079login required≤ 2024.2

    WordPress Advanced iFrame plugin <= 2024.2 - Cross Site Scripting (XSS) vulnerability

    Medium 6.5

  • CVE-2026-6742contributor+≤ 2026.1

    Advanced iFrame <= 2026.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gutenberg Block 'additional' Attribute

    Medium 6.4

  • CVE-2025-6987contributor+≤ 2025.5

    Advanced iFrame <= 2025.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

    Medium 6.4

  • CVE-2024-4365contributor+≤ 2024.3

    Advanced iFrame <= 2024.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

    Medium 6.4

  • CVE-2024-24870login required≤ 2023.10

    WordPress Advanced iFrame Plugin <= 2023.10 is vulnerable to Cross Site Scripting (XSS)

    Medium 5.4

  • CVE-2023-51690login required≤ 2023.8

    WordPress Advanced iFrame Plugin <= 2023.8 is vulnerable to Cross Site Scripting (XSS)

    Medium 5.4

  • CVE-2025-8089contributor+≤ 2025.6

    Advanced iFrame <= 2025.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

    Medium 5.4

  • CVE-2025-1439contributor+≤ 2024.5

    Advanced iFrame <= 2024.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Host Header

    Medium 5.4

  • CVE-2025-1437contributor+≤ 2025.2

    Advanced iFrame <= 2025.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

    Medium 5.4

  • CVE-2024-1341contributor+≤ 2024.1

    Advanced iFrame <= 2024.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

    Medium 5.4

  • CVE-2023-7069contributor+≤ 2023.10

    Advanced iFrame <= 2023.10 - Authenticated (Contributor+) Stored Cross-Site Scripting

    Medium 5.4

  • CVE-2023-4775contributor+≤ 2023.8

    Advanced iFrame <= 2023.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    Medium 5.4

  • CVE-2025-1440unauthenticated≤ 2024.5

    Advanced iFrame <= 2024.5 - Unauthenticated Settings Update

    Medium 5.3

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory