The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘additional’ parameter in versions less than or equal to 2025.6 due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts into pages, which will execute whenever a user accesses the affected page.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.4 | CVE-2025-8089 |
Exploitation
To exploit this vulnerability, an attacker with contributor-level access can craft a malicious payload and inject it into the ‘additional’ parameter of the Advanced iFrame plugin. When a user accesses the page containing the injected script, it will execute in their browser, potentially leading to unauthorized actions or data exposure.
Affected Products
- Advanced iFrame plugin for WordPress (versions <= 2025.6): This plugin allows users to embed iframes in their WordPress pages, but the vulnerability can lead to serious security issues if exploited.
Mitigation
To mitigate this vulnerability, users should update the Advanced iFrame plugin to the latest version that addresses the input sanitization and output escaping issues. Additionally, it is recommended to review user access levels and limit contributor access where possible.