CVE-2024-9449
Published
CVSS v3
6.4
MEDIUM
CVSS v2
N/A
Affected
1
PROJECT
Description
The Auto iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' parameter in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
<p>A quick and easy shortcode to embed iframe’s that resize to the content of the remote site.</p>
<p>Auto iFrame shortcode is in the format of:</p>
<pre><code>[auto-iframe link=xxx tag=xxx width=xxx height=xxx autosize=yes/no]
</code></pre>
<p>Where:</p>
<ul>
<li>link = the url of the source for the iFrame. REQUIRED.</li>
<li>tag = a unique identifier in case you want more than one iFrame on a page. Default = auto-iframe.</li>
<li>width = width of the iFrame (100% by default). Can be % or px. Default = 100%.</li>
<li>height = the initial height of the iframe (100% by default). Can be % or px. Default = 100%.</li>
<li>autosize = enable the auto sizing of the iFrame based on the content. The initial height of the iFrame will be set to “height” and then resized. Default = true.</li>
<li>fudge = a fudge factor to apply when changing the height (integer number, no “px”). Default = 50.</li>
<li>border = enable the border on the iFrame. Default = 0.</li>
<li>scroll = enable the scroll bar on the iFrame. Default = no.</li>
<li>query = pass the parent’s page query string to the iFrame. Default = no.</li>
</ul>
<p>Note: Auto re-sizing of the iFrame for cross domain sites does not work, this is a security protection provided by the browser and there is no way around it.</p>
<p>Now supports (Shortcode UI)[https://github.com/fusioneng/Shortcake] (aka Shortcake)!</p>
WordPress Plugin Directory