CVE-2024-1341 is a stored Cross-Site Scripting vulnerability in the Advanced iFrame plugin for WordPress. The issue arises because the plugin permits inclusion of JavaScript files from external sources via the additional_js attribute in the advanced_iframe shortcode. Authenticated users with contributor-level or higher permissions can exploit this to inject malicious scripts that execute in the context of any user viewing the compromised page. This vulnerability affects all plugin versions up to 2024.1 and has a CVSS 3.1 base score of 4.9, indicating medium severity. No patch or official fix has been documented in the provided data.

Successful exploitation allows an authenticated contributor or higher to inject persistent malicious JavaScript into pages, which executes in the browsers of users who visit those pages. This can lead to limited confidentiality and integrity impacts, such as session hijacking or content manipulation. The attack requires authentication with contributor-level permissions and has no impact on availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level permissions to trusted users only and consider disabling or limiting use of the additional_js attribute in the advanced_iframe shortcode if possible. Monitor vendor channels for updates and apply patches promptly once released.