Read the docs

mdempfle

Records28All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9

Exploited now

mdempfle records in CISA KEV

No mdempfle vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Tinywebgallery 13 records HIGH Advanced Iframe 9 records LOW Wordpress Flash Uploader 1 record MEDIUM

Records

9 records in Advanced Iframe · all components

TI-2025-01239 CVE-2025-1440 · GHSA-cjm8-5v4m-pvxc

Advanced iFrame <= 2024.5 - Unauthenticated Settings Update

Priority LOW 30

The Advanced iFrame plugin for WordPress is vulnerable to unauthorized excessive creation of options on the aip_map_url_callback() function in all versions up to, and including, 2024.5 due to insufficient restrictions.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00299 Published 2025-03-26 No fix listed CWE-20
TI-2023-04402 CVE-2023-4775 · GHSA-258f-3vwc-4rjv

Advanced iFrame <= 2023.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Priority LOW 29

The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'advanced_iframe' shortcode in versions up to, and including, 2023.8 due to insufficient input sanitization and output escapin…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00553 Published 2023-11-13 No fix listed CWE-79
TI-2021-07232 CVE-2021-24953 · GHSA-mfjw-6wwh-h7vf

Advanced iFrame < 2022 - Reflected Cross-Site Scripting

Priority LOW 29

The Advanced iFrame WordPress plugin before 2022 does not sanitise and escape the ai_config_id parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.008 Published 2022-03-07 Fixed in 2022 CWE-79
TI-2025-01238 CVE-2025-1439 · GHSA-qw2f-592p-2xm4

Advanced iFrame <= 2024.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Host Header

Priority LOW 28

The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advanced_iframe' shortcode in all versions up to, and including, 2024.5 due to insufficient input sanitization and o…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00214 Published 2025-03-26 No fix listed CWE-79
TI-2025-01237 CVE-2025-1437 · GHSA-4c69-v677-qpvh

Advanced iFrame <= 2025.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

Priority LOW 28

The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advanced_iframe' shortcode in all versions up to, and including, 2025.2 due to insufficient input sanitization and o…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00267 Published 2025-03-26 No fix listed CWE-79
TI-2023-06465 CVE-2023-7069 · GHSA-c56q-fqmf-hg57

Advanced iFrame <= 2023.10 - Authenticated (Contributor+) Stored Cross-Site Scripting

Priority LOW 28

The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advanced_iframe' shortcode in all versions up to, and including, 2023.10 due to insufficient input sanitization and…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00313 Published 2024-02-01 No fix listed CWE-79
TI-2024-01250 CVE-2024-1341 · GHSA-pg9j-xv4w-ppqv

Advanced iFrame <= 2024.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Priority LOW 24

The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's advanced_iframe shortcode in all versions up to, and including, 2024.1 due to the plugin allowing users to include JS…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00279 Published 2024-02-29 No fix listed CWE-79
Open these records in search →