PT-2025-1946 · WordPress · Responsive Iframe Wordpress Plugin

Sakotas · Published 2025-02-01 · Updated 2025-05-12 · CVE-2024-12768

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Responsive iframe WordPress plugin versions 1.2.0 and earlier

Description The issue concerns the failure to validate and escape certain block options before they are outputted back in a page or post where the block is embedded. This could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Recommendations For The Responsive iframe WordPress plugin versions 1.2.0 and earlier, consider disabling the embedding of blocks that use unvalidated options until a patch is available. Restrict access to block options to minimize the risk of exploitation. Avoid using the block embedding feature in the affected plugin until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-12768

Affected Products

Responsive Iframe Wordpress Plugin

References · 8

• 🔥 https://wpscan.com/vulnerability/fe2e47f4-b89e-4c22-8d27-672da0fb99af · Exploit
• https://osv.dev/vulnerability/CVE-2024-12768 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-12768 · Security Note
• https://twitter.com/CVEnew/status/1885579376785580519 · Twitter Post
• https://t.me/cvenotify/109583 · Telegram Post
• https://twitter.com/taqtics_ai/status/1895995755329896468 · Twitter Post
• https://t.me/cvenotify/121703 · Telegram Post
• https://t.me/cvedetector/16993 · Telegram Post