CVE-2026-25453

The Advanced iFrame plugin for WordPress contains a security flaw that allows malicious users with contributor privileges or higher to embed malicious code into certain pages, which can then be executed by other users who visit those pages, compromising the integrity of the site's content. This vulnerability stems from inadequate measures taken to cleanse and sanitize user input before it is displayed on the page. The issue affects plugin versions up through 2025.10.

Based on public CVE data (MITRE/NVD).