Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

9 records

Vendor: mdempfle Component: Advanced Iframe Clear all filters
TI-2025-01239 CVE-2025-1440 · GHSA-cjm8-5v4m-pvxc

Advanced iFrame <= 2024.5 - Unauthenticated Settings Update

Priority LOW 30

The Advanced iFrame plugin for WordPress is vulnerable to unauthorized excessive creation of options on the aip_map_url_callback() function in all versions up to, and including, 2024.5 due to insufficient restrictions.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00299 Published 2025-03-26 No fix listed CWE-20
TI-2025-01237 CVE-2025-1437 · GHSA-4c69-v677-qpvh

Advanced iFrame <= 2025.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

Priority LOW 28

The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advanced_iframe' shortcode in all versions up to, and including, 2025.2 due to insufficient input sanitization and o…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00267 Published 2025-03-26 No fix listed CWE-79
TI-2025-01238 CVE-2025-1439 · GHSA-qw2f-592p-2xm4

Advanced iFrame <= 2024.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Host Header

Priority LOW 28

The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advanced_iframe' shortcode in all versions up to, and including, 2024.5 due to insufficient input sanitization and o…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00214 Published 2025-03-26 No fix listed CWE-79
TI-2024-01250 CVE-2024-1341 · GHSA-pg9j-xv4w-ppqv

Advanced iFrame <= 2024.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Priority LOW 24

The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's advanced_iframe shortcode in all versions up to, and including, 2024.1 due to the plugin allowing users to include JS…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00279 Published 2024-02-29 No fix listed CWE-79
TI-2023-06465 CVE-2023-7069 · GHSA-c56q-fqmf-hg57

Advanced iFrame <= 2023.10 - Authenticated (Contributor+) Stored Cross-Site Scripting

Priority LOW 28

The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advanced_iframe' shortcode in all versions up to, and including, 2023.10 due to insufficient input sanitization and…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00313 Published 2024-02-01 No fix listed CWE-79
TI-2023-04402 CVE-2023-4775 · GHSA-258f-3vwc-4rjv

Advanced iFrame <= 2023.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Priority LOW 29

The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'advanced_iframe' shortcode in versions up to, and including, 2023.8 due to insufficient input sanitization and output escapin…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00553 Published 2023-11-13 No fix listed CWE-79
TI-2021-07232 CVE-2021-24953 · GHSA-mfjw-6wwh-h7vf

Advanced iFrame < 2022 - Reflected Cross-Site Scripting

Priority LOW 29

The Advanced iFrame WordPress plugin before 2022 does not sanitise and escape the ai_config_id parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.008 Published 2022-03-07 Fixed in 2022 CWE-79