CVE-2025-8089mediumCWE-79

CVE-2025-8089: fallo de gravedad media en mdempfle Advanced iFrame

Advanced iFrame <= 2025.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Advanced iFrame

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.4epss 0.3%
The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'additional' parameter in version less than, or equal to, 2025.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Productos afectados
mdempfle · Advanced iFrame
CVEs relacionadas — mdempfle Advanced iFrame

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-4775MEDIUMAdvanced iFrame <= 2023.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.6%CVE-2025-6987MEDIUMAdvanced iFrame <= 2025.5 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-4365MEDIUMAdvanced iFrame <= 2024.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2023-7069MEDIUMAdvanced iFrame <= 2023.10 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-1440MEDIUMAdvanced iFrame <= 2024.5 - Unauthenticated Settings UpdateEPSS 0.3%CVE-2024-1341MEDIUMAdvanced iFrame <= 2024.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%