Stored Cross-Site Scripting Vulnerability in Advanced iFrame Plugin for WordPress

CVE-2023-4775

What is CVE-2023-4775?

The Advanced iFrame plugin for WordPress suffers from a vulnerability that allows authenticated users with contributor-level permissions and above to inject malicious scripts. This occurs via the 'advanced_iframe' shortcode, where inadequate input sanitization and output escaping of user-supplied attributes lead to potential exploitation. As a result, arbitrary web scripts can be executed on pages upon access, posing significant security risks to users.

References