Auto iFrame

Auto iFrame has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2024; all 2 are fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10. 2024 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Scripting, behind 2 of the records (100%).

Every one of the 2 issues recorded for Auto iFrame has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, one record each. Auto iFrame is installed on roughly 3,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.6.7.

Strategic Overview

Avg CVSSMedium

6.4/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Auto iFrame vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2024-10151

Auto iFrame <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

2 records


2024-12-18 00:00	Auto iFrame <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting Auto iFrame <= 1.9	`CVE-2024-10151`	6.4 Medium	Bob Matyas	Yes
2024-10-08 17:35	Auto iFrame <= 1.7 - Authenticated (Author+) Stored Cross-Site Scripting via tag Parameter Auto iFrame <= 1.7	`CVE-2024-9449`	6.4 Medium	tjoffe	Yes

Showing 1–2 of 2 reports

Latestv2.0

Auto iFrame

Author

Greg Ross

3.6(18)

72/100

Last Updated

2024-12-02 (2y ago)

Active Installs

3,000+

Downloads

89,441

Requires WP

3.0+

Requires PHP

Tested up to

WP 6.6.7

Created

2015-03-25 (12y ago)

A quick and easy shortcode to embed iframe’s that resize to the content of the remote site. Auto iFrame shortcode is in the format of: [auto-iframe link=xxx tag=xxx width=xxx height=xxx autosize=yes/no] Where: link = the url of the source for the iFrame. REQUIRED. tag = a unique identifier in case you want more than one iFrame on a page. Default = auto-iframe. width = width of the iFrame (100% by default). Can be % or px. Default = 100%. height = the initial height of the iframe (100% by default). Can be % or px. Default = 100%. autosize = enable the auto sizing of the iFrame based on the content. The initial height of the iFrame will be set to “height” and then resized. Default = true. fudge = a fudge factor to apply when changing the height (integer number, no “px”). Default = 50. border = enable the border on the iFrame. Default = 0. scroll = enable the scroll bar on the iFrame. Default = no. query = pass the parent’s page query string to the iFrame. Default = no. Note: Auto re-sizing of the iFrame for cross domain sites does not work, this is a security protection provided by the browser and there is no way around it. Now supports (Shortcode UI)[https://github.com/fusioneng/Shortcake] (aka Shortcake)!

View on WordPress.org