Vulnerabilities

TI-2023-28564 CVE-2023-52125 · GHSA-9wr3-3xxw-mvrx

WordPress iFrame Plugin <= 4.8 is vulnerable to Cross Site Scripting (XSS)

LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webvitaly iframe allows Stored XSS.This issue affects iframe: from n/a through 4.8.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00328 Published 2024-01-05 No fix listed CWE-79

TI-2023-04530 CVE-2023-4919 · GHSA-fhx9-p329-4x23

iframe <= 4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'iframe' Shortcode

LOW 29

The iframe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `iframe` shortcode in versions up to, and including, 4.6 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00599 Published 2023-10-20 No fix listed CWE-79

TI-2023-10016 CVE-2023-24394 · GHSA-p8xr-3fgh-5q5f

WordPress iframe popup Plugin <= 3.3 is vulnerable to Cross Site Scripting (XSS)

LOW 27

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy iframe popup plugin <= 3.3 versions.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00369 Published 2023-08-25 No fix listed CWE-79

TI-2020-10095 CVE-2020-12696 · GHSA-x6c7-c3v8-xmwc

The iframe plugin before 4.5 for WordPress does not sanitize a URL.

LOW 31

The iframe plugin before 4.5 for WordPress does not sanitize a URL.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.02006 Published 2020-05-07 No fix listed CWE-79

Vulnerabilities

Filters

WordPress iFrame Plugin <= 4.8 is vulnerable to Cross Site Scripting (XSS)

iframe <= 4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'iframe' Shortcode

WordPress iframe popup Plugin <= 3.3 is vulnerable to Cross Site Scripting (XSS)

The iframe plugin before 4.5 for WordPress does not sanitize a URL.