CVE-2025-1437 is a stored cross-site scripting vulnerability in the mdempfle Advanced iFrame WordPress plugin. It arises from improper neutralization of input during web page generation, specifically in the 'advanced_iframe' shortcode. Authenticated attackers with contributor or higher privileges can inject arbitrary scripts via user-supplied shortcode attributes. The vulnerability affects all versions up to 2025.2. Partial fixes were applied in version 2024.5 and improved in 2025.3, addressing input sanitization and output escaping issues.

Successful exploitation allows an authenticated contributor or higher to inject persistent malicious scripts into pages, which execute in the context of any user viewing those pages. This can lead to information disclosure and integrity impacts, such as session hijacking or unauthorized actions performed on behalf of users. The vulnerability does not affect availability. The CVSS vector indicates network attack vector, low attack complexity, privileges required at low level, no user interaction, and scope change with low confidentiality and integrity impacts.

Users should upgrade the Advanced iFrame plugin to version 2025.3 or later, where the vulnerability has been fully addressed. Partial fixes in version 2024.5 do not fully mitigate the issue. Since this is not a cloud service, remediation depends on applying the official plugin update. No known exploits are reported in the wild at this time.