{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-1437", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-02-18T15:09:17.346Z", "datePublished": "2025-03-26T09:21:41.809Z", "dateUpdated": "2026-04-08T16:58:13.133Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:58:13.133Z"}, "affected": [{"vendor": "mdempfle", "product": "Advanced iFrame", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2025.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advanced_iframe' shortcode in all versions up to, and including, 2025.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This was partially patched in version 2024.5, and later improved in version 2025.3."}], "title": "Advanced iFrame <= 2025.2 - Authenticated (Contributor+) Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/676b4768-98ea-4e55-87de-ef7ae1d7a113?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3255604%40advanced-iframe&new=3255604%40advanced-iframe&sfp_email=&sfph_mail="}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3279464%40advanced-iframe&new=3279464%40advanced-iframe&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Luciano Hanna"}], "timeline": [{"time": "2025-07-24T18:06:15.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-03-25T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-26T18:34:22.201209Z", "id": "CVE-2025-1437", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-26T18:38:20.604Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-1437", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-26T18:34:22.201209Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-26T18:38:14.853Z"}}], "cna": {"title": "Advanced iFrame <= 2025.2 - Authenticated (Contributor+) Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "Luciano Hanna"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "mdempfle", "product": "Advanced iFrame", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2025.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-07-24T18:06:15.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-03-25T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/676b4768-98ea-4e55-87de-ef7ae1d7a113?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3255604%40advanced-iframe&new=3255604%40advanced-iframe&sfp_email=&sfph_mail="}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3279464%40advanced-iframe&new=3279464%40advanced-iframe&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advanced_iframe' shortcode in all versions up to, and including, 2025.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This was partially patched in version 2024.5, and later improved in version 2025.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:58:13.133Z"}}}, "cveMetadata": {"cveId": "CVE-2025-1437", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:58:13.133Z", "dateReserved": "2025-02-18T15:09:17.346Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-03-26T09:21:41.809Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:tinywebgallery:advanced_iframe:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "AF8E33EC-AF16-47EE-A903-EBA8BEB72D96", "versionEndExcluding": "2025.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advanced_iframe' shortcode in all versions up to, and including, 2025.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This was partially patched in version 2024.5, and later improved in version 2025.3."}, {"lang": "es", "value": "El complemento Advanced iFrame para WordPress es vulnerable a Cross-Site Scripting Almacenado a trav\u00e9s del shortcode 'advanced_iframe' en todas las versiones hasta la 2024.5 incluida, debido a una depuraci\u00f3n de entrada y al escape de salida insuficiente en los atributos proporcionados por el usuario. Esto permite a atacantes autenticados, con acceso de colaborador o superior, inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n al acceder un usuario a una p\u00e1gina inyectada."}], "id": "CVE-2025-1437", "lastModified": "2026-04-08T18:24:24.097", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-03-26T10:15:14.930", "references": [{"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3255604%40advanced-iframe&new=3255604%40advanced-iframe&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3279464%40advanced-iframe&new=3279464%40advanced-iframe&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/676b4768-98ea-4e55-87de-ef7ae1d7a113?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T21:40:16.840250+00:00", "value": {"mitigation_remediation": ["Upgrade the Advanced iFrame plugin to version 2025.3 or later, which incorporates proper input validation and output escaping for the shortcode.", "Restrict contributor or lower roles from inserting or editing content that may use the problematic shortcode; consider revoking permission to use advanced\u2011iframe or removing the shortcode from public posts.", "Verify that the plugin\u2019s shortcode output is properly escaped using WordPress\u2019s built\u2011in sanitization functions, and if not, apply a custom filter to escape any user\u2011supplied attributes before rendering."], "summary": {"action": "Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Advanced iFrame plugin for WordPress distributed by mdempfle. All released versions up to and including 2025.2 are affected; later releases (2025.3 and onward) include the fix.", "description_and_impact": "The Advanced iFrame WordPress plugin allows users to embed content via a shortcode. Because insufficient input sanitization and output escaping were implemented, an attacker with contributor-level access can inject arbitrary JavaScript into the shortcode attributes. The victim\u2019s browser executes the script when the page containing the shortcode is viewed, enabling session hijacking, defacement, or other client\u2011side attacks. This flaw is categorized as a classic input validation weakness (CWE\u201179).", "risk_and_exploitability": "The CVSS score of 6.4 indicates a moderate severity. The EPSS score of less than 1% suggests exploitation is unlikely in the short term, and the flaw is not listed in CISA\u2019s KEV catalog. The attack requires authenticated access of contributor role or higher, likely via the WordPress admin interface where the attacker can edit or insert content containing the malicious shortcode. Once stored, the payload auto\u2011executes for any user who views the affected page."}}}}, "created": "2025-07-12T23:06:28.688943+00:00", "updated": "2026-04-21T21:45:25.848210+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}