CVE-2026-6742

The Advanced iFrame plugin for WordPress contains a security flaw that allows malicious users with contributor-level access or higher to inject unauthorized code into website content via the 'additional' parameter in versions prior to 2026.1, enabling potential attacks on unsuspecting visitors when they view affected pages. This vulnerability stems from inadequate filtering of user input and insufficient protection against script injection.

Based on public CVE data (MITRE/NVD).