CVE-2026-6742

Name of the Vulnerable Software and Affected Versions Advanced iFrame versions prior to 2026.2

Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting arbitrary web scripts through the additional parameter in the Gutenberg Block, which then execute when a user visits the affected page.

Recommendations Update Advanced iFrame to version 2026.2 or later. As a temporary mitigation, restrict access to the additional parameter for users with contributor-level permissions.