CVE-2023-2964

Simple Iframe < 1.2.0 - Contributor+ Stored XSS

The Simple Iframe WordPress plugin before 1.2.0 does not properly validate one of its WordPress block attribute's content, which may allow users whose role is at least that of a contributor to conduct Stored Cross-Site Scripting attacks.

Affected

Simple Iframe

CVSS v3.1 NVD

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.54% chance of exploitation in the next 30 days, 45th percentile

Published

2023-07-10

Updated

2025-04-23

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/97aac334-5323-41bb-90f0-d180bcc9162f

References

• CVE Record
• NVD entry