CVE-2023-52125

The iFrame plugin for WordPress contains a stored cross-site scripting vulnerability in version 4.8 and earlier through the srcdoc parameter, which lacks proper input validation and output encoding. Authenticated users with contributor privileges or higher can inject malicious scripts that execute when other users view affected pages, though the injection is restricted to the iframe's scope and cannot be used to compromise administrator credentials or sessions.

Based on public CVE data (MITRE/NVD).