CVE-2025-1439

Summary

CVE-2025-1439 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Advanced iFrame plugin for WordPress. This issue allows authenticated attackers with contributor-level access and above to inject malicious scripts by exploiting insufficient input sanitization and output escaping on user-supplied attributes in the 'src' attribute of the plugin's 'advanced_iframe' shortcode. When an injected page is accessed, the injected scripts will execute, potentially compromising user data or taking control of the affected site. Versions up to and including 2024.5 are vulnerable to this attack.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.