CVE-2025-6987 is a stored cross-site scripting vulnerability in the Advanced iFrame WordPress plugin by mdempfle, affecting all versions up to 2025.5. The issue stems from improper neutralization of input during web page generation (CWE-79) in the 'advanced_iframe' shortcode, where user-supplied attributes are not adequately sanitized or escaped. Authenticated attackers with contributor-level permissions or higher can exploit this to inject arbitrary web scripts that execute in the context of users visiting the compromised pages. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges, no user interaction, and impacts confidentiality and integrity with no availability impact.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable shortcode. These scripts execute in the browsers of users who visit the injected pages, potentially leading to data theft, session hijacking, or other unauthorized actions affecting confidentiality and integrity. Availability is not impacted. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access carefully and consider disabling or removing the Advanced iFrame plugin if possible. Monitor official mdempfle or WordPress security advisories for updates regarding patches or mitigations.