Stored Cross-Site Scripting Vulnerability in UltraEmbed - Advanced Iframe Plugin for WordPress

CVE-2024-11335

Summary

The UltraEmbed – Advanced Iframe Plugin for WordPress has a security flaw that allows authenticated users with contributor-level access and above to execute arbitrary scripts. This stored cross-site scripting vulnerability arises from inadequate sanitization of user input and insufficient output escaping when utilizing the plugin's 'iframe' shortcode. As a result, malicious users can inject harmful web scripts in pages, which will execute whenever a visitor accesses those compromised pages. Users are urged to review their current plugin version and apply updates to mitigate potential risks.

References