What is the CVSS score of CVE-2026-6742?

CVE-2026-6742 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Advanced iFrame CVE-2026-6742

EUVD-2026-42219 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-08 Wordfence

GHSA-5fx8-gw78-r8q8

WordPress XSS Advanced Iframe Wordpress Plugin

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Stored XSS requires a victim to load the injected page (UI:R); all other metrics align with the provided vector.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 12:42 vuln.today

CVE Published

Jul 08, 2026 - 11:35 nvd

MEDIUM 6.4

DescriptionCVE.org

The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'additional' parameter in all versions up to, and including, 2026.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the Advanced iFrame WordPress plugin (versions through 2026.1) allows authenticated contributors to permanently inject malicious scripts into WordPress pages via the unsanitized 'additional' parameter. Any site visitor loading an affected page will execute the attacker's payload in their browser, enabling session hijacking, credential theft, or defacement. No public exploit has been identified at time of analysis, and a fix has been committed to the WordPress plugin repository per Wordfence reporting.

Technical ContextAI

Advanced iFrame (CPE: cpe:2.3:a:mdempfle:advanced_iframe:*:*:*:*:*:*:*:*) is a WordPress plugin for embedding external pages and iframes with advanced configuration options. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a stored XSS variant: the plugin's 'additional' parameter - likely used to pass supplementary iframe attributes or configuration - is neither sanitized on input nor escaped on output. Because WordPress contributor-level users can place shortcodes or blocks on pages, they have write access to the parameter value, which is then rendered unescaped in page HTML served to all subsequent visitors. The CVSS scope-change (S:C) reflects that the injected script executes in the victim's browser security context, not the server's.

RemediationAI

Update the Advanced iFrame plugin to the version corresponding to changeset 3558422 or later via the WordPress admin dashboard (Plugins → Updates) or WP-CLI (wp plugin update advanced-iframe). The fix is available in the WordPress plugin repository per https://plugins.trac.wordpress.org/changeset/3558422/advanced-iframe, but the exact patched version number is not independently confirmed from available data - verify the installed version against the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/2b9c4ca8-e5cd-4c4f-8d81-b06367c89fd7. As a compensating control prior to patching, restrict contributor-level role assignment to fully trusted users only, or use a capability management plugin to prevent contributors from using the Advanced iFrame shortcode/block. A web application firewall rule targeting stored XSS patterns in the 'additional' parameter can provide defense-in-depth but should not substitute for patching.