CVE-2024-1341 in Advanced iFrame Plugin
Summary
by MITRE • 02/29/2024
The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's advanced_iframe shortcode in all versions up to, and including, 2024.1 due to the plugin allowing users to include JS files from external sources through the additional_js attribute. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 04/12/2026
The Advanced iFrame plugin for WordPress represents a critical security vulnerability classified as CVE-2024-1341, which affects all versions up to and including 2024.1. This vulnerability manifests as a stored cross-site scripting flaw that specifically targets the plugin's advanced_iframe shortcode implementation. The security weakness stems from the plugin's design allowing users to incorporate JavaScript files from external sources through the additional_js attribute, creating an attack vector that can be exploited by authenticated users possessing contributor-level permissions or higher. The vulnerability's classification aligns with CWE-79, which addresses cross-site scripting flaws, and demonstrates how web application frameworks can inadvertently create opportunities for malicious code execution through seemingly benign configuration options.
The technical exploitation of this vulnerability occurs through the manipulation of the additional_js attribute within the advanced_iframe shortcode, which permits the inclusion of external JavaScript resources. When authenticated attackers with contributor-level privileges or higher utilize this functionality, they can inject malicious scripts that persist within the WordPress environment. These stored scripts execute whenever any user accesses pages containing the compromised shortcode, creating a persistent threat that can affect all visitors to the affected WordPress site. The vulnerability's impact is amplified by the fact that contributors typically have sufficient permissions to modify content, making the attack surface more accessible than would be the case with higher privilege requirements.
From an operational perspective, this vulnerability presents significant risks to WordPress site administrators and their users. The stored nature of the XSS attack means that malicious scripts remain active even after the initial exploitation, continuously executing against any user who accesses affected pages. This creates a persistent threat vector that can be leveraged for various malicious activities including credential theft, session hijacking, or redirection to malicious sites. The vulnerability affects the core integrity of the WordPress platform by allowing unauthorized code execution within the context of the victim's browser, potentially compromising the security of the entire site and its user base.
The mitigation strategy for CVE-2024-1341 requires immediate attention from WordPress administrators, with the primary recommendation being the immediate upgrade to the latest plugin version that addresses this vulnerability. System administrators should also implement additional protective measures including restricting contributor-level user permissions where possible, implementing strict content validation for shortcode attributes, and monitoring for unauthorized script injections. The ATT&CK framework categorizes this vulnerability under T1059.007 for scripting languages and T1566 for credential access, highlighting the potential for both code execution and data exfiltration. Organizations should also consider implementing Content Security Policy headers to limit the sources from which scripts can be loaded, providing an additional layer of protection against similar vulnerabilities in the future.