CVE Database /
CVE-2024-4365
CVE · Medium
CVE-2024-4365 — Advanced iFrame [advanced-iframe] < 2024.4
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2024-4365
|
Advanced iFrame [advanced-iframe] < 2024.4 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
6.4
|
< 2024.4
|
2024.4 |
2024-05-22 |
—
|
CVE-2024-4365
The Advanced iFrame plugin for WordPress contains a stored cross-site scripting vulnerability in versions up to 2024.3 affecting the 'add_iframe_url_as_param_direct' parameter. Authenticated users with contributor-level access or higher can inject malicious scripts due to inadequate sanitization and escaping of inputs. These injected scripts execute when other users view the affected pages. The vulnerability has been fixed in version 2024.4.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings