Show filters
6 Total Results
Displaying 1-6 of 6
Sort by:
Attacker Value
Unknown
CVE-2023-52125
Disclosure Date: January 05, 2024 (last updated January 10, 2024)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webvitaly iframe allows Stored XSS.This issue affects iframe: from n/a through 4.8.
0
Attacker Value
Unknown
CVE-2023-4919
Disclosure Date: October 20, 2023 (last updated October 28, 2023)
The iframe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `iframe` shortcode in versions up to, and including, 4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permission and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This was partially patched in version 4.6 and fully patched in version 4.7.
0
Attacker Value
Unknown
CVE-2023-24394
Disclosure Date: August 25, 2023 (last updated October 08, 2023)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy iframe popup plugin <= 3.3 versions.
0
Attacker Value
Unknown
CVE-2023-2964
Disclosure Date: July 10, 2023 (last updated October 08, 2023)
The Simple Iframe WordPress plugin before 1.2.0 does not properly validate one of its WordPress block attribute's content, which may allow users whose role is at least that of a contributor to conduct Stored Cross-Site Scripting attacks.
0
Attacker Value
Unknown
CVE-2023-29436
Disclosure Date: June 26, 2023 (last updated October 08, 2023)
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Flyn San IFrame Shortcode plugin <= 1.0.5 versions.
0
Attacker Value
Unknown
CVE-2020-12696
Disclosure Date: May 07, 2020 (last updated February 21, 2025)
The iframe plugin before 4.5 for WordPress does not sanitize a URL.
0
