CVE-2024-4365

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘add_iframe_url_as_param_direct’ parameter in versions up to, and including, 2024.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
mdempfleAdvanced iFrame<= 2024.3

References

Timeline

Published
May 23, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-436509.3Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Iocharger firmware for AC models allowsCVE-2024-436519.3Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability allows OS Command Injection as root This iCVE-2024-436528.8Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability allows OS Command Injection as root This iCVE-2024-436538.8Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability  allows OS Command Injection as root This CVE-2024-436548.8Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Iocharger firmware for AC models allowCVE-2024-436559.3Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability allows OS Command Injection as root This CVE-2024-436568.8Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability allows OS Command Injection as root This CVE-2024-436578.8Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability allows OS Command Injection as root This CVE-2024-436587.2Patch traversal, External Control of File Name or Path vulnerability in Iocharger Home allows deletion of arbitrary files This issue affectCVE-2024-436597.2After gaining access to the firmware of a charging station, a file at <redacted> can be accessed to obtain default credentials that are the CVE-2024-43665.4The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘block_id’ parameter in vCVE-2024-436607.5The CGI script <redacted>.sh can be used to download any file on the filesystem. This issue affects Iocharger firmware for AC model charger
CVE-2024-4365: Medium severity, CVSS 6.4 | Vulnix