Stored Cross-Site Scripting Vulnerability in UltraEmbed - Advanced Iframe Plugin for WordPress
CVE-2024-11335
6.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 19 February 2025
What is CVE-2024-11335?
The UltraEmbed – Advanced Iframe Plugin for WordPress has a security flaw that allows authenticated users with contributor-level access and above to execute arbitrary scripts. This stored cross-site scripting vulnerability arises from inadequate sanitization of user input and insufficient output escaping when utilizing the plugin's 'iframe' shortcode. As a result, malicious users can inject harmful web scripts in pages, which will execute whenever a visitor accesses those compromised pages. Users are urged to review their current plugin version and apply updates to mitigate potential risks.
Affected Version(s)
UltraEmbed – Advanced Iframe Plugin For WordPress with Gutenberg Block Included * <= 1.0.3