Advanced Iframe Pro is a WordPress plugin that enables users to embed iframes and external content directly into posts, pages, and custom locations with granular control over appearance, functionality, and security. The plugin provides extensive customization options for responsive design, allowing embedded content to adapt to different screen sizes and devices while maintaining security through various protective measures.

Key Features

Iframe Embedding - Insert iframes into posts, pages, widgets, and custom locations using shortcodes or blocks
Responsive Design - Automatically scale embedded content to fit different screen sizes and maintain aspect ratios
Security Controls - Configure sandbox attributes, content security policies, and access restrictions for embedded content
Custom Styling - Apply custom CSS and styling options to modify the appearance of embedded iframes
Height and Width Control - Set fixed or dynamic dimensions for embedded content with pixel or percentage-based sizing
Scrolling Options - Enable or disable scrollbars and control overflow behavior for embedded content
Border and Frame Styling - Customize borders, margins, padding, and other frame-level styling properties
Content Filtering - Filter and modify embedded content before display with various processing options
Shortcode Support - Use intuitive shortcodes to embed iframes with customizable parameters
Block Editor Integration - Native Gutenberg block support for easy iframe insertion in the WordPress editor
Advanced Attributes - Configure allow attributes, referrer policies, and other iframe security settings
Mobile Optimization - Specific options for optimizing embedded content display on mobile devices

Best For

Advanced Iframe Pro is ideal for website owners who need to embed external content such as videos, maps, surveys, calculators, or third-party applications into their WordPress site while maintaining control over appearance and security. It serves developers and content creators who require flexible iframe customization without writing custom code, and organizations that need to enforce security policies when embedding untrusted external content.

Changelog

Other

Breaking change: Due to the security fix for "Add iframe URL as param" and "Prefix/id/urlrewrite for iframe URL," the hash/hashrewrite needs to be set in both the administration AND the shortcode.
Breaking change: The postMessage send from the iframe is only processed if the feature is enabled. This was added for: "Add iframe URL as param", "Use the iframe title for the parent", "Include content directly from the iframe". Please read the updated documentation. Most users will not have to do anything, because the default way to configure this features by the administration, has not changed. If is only different if you configured them directly in the ai_external.js
Security fix: The feature "Include content directly from the iframe" was accepting any postMessage in the correct structure and adding it to the parent page. Now the feature needs to be enabled and also the input is sanitized by removing all script tags. If you enable this feature only the configured keys are accepted. Make sure that you trust the page you include as you extract content from there!
Security fix: Cross-Site Scripting (XSS) was reported by Patch Stack. The setting additional_height has now XSS detection. The same sanitation was also applied to iframe_zoom and onload_scroll_top. See https://www.wordfence.com/threat-intel/vulnerabilities/id/dcdcb29e-48d0-4e22-8e11-0c76b4355268 and https://patchstack.com/database/Wordpress/Plugin/advanced-iframe/vulnerability/wordpress-advanced-iframe-plugin-2025-10-cross-site-scripting-xss-vulnerability?_s_id=cve
Security fix: Broken Access Control reported by the patch stack has been fixed. There is no official CVE number yet. The URL cache is now a first-in, first-out (FIFO) cache and cannot be fully filled anymore. The cache is now only active if "Add iframe URL as param" with hash/hashrewrite is enabled. The cache size is now shown in the administration, and additional documentation has been added.
Security fix: At hide_part_of_iframe the URL was escaped with esc_html and not esc_url. Now settings like javascript:alert%28document.domain%29 are removed.

Added

Tested with WordPress 6.9.1
Tested with PHP 8.5. The entire code was also analyzed with ChatGPT 5.2, which reported no breaking changes.
The minimum PHP version has been increased to 7.4. While the plugin itself still works with lower versions, such PHP versions are insecure and should no longer be used!
The minimum WordPress version was increased to 5.5. The plugin works with older versions of WordPress, but they are insecure and should not be used.

Fixed

user meta and user info data output is using esc_html to avoid that invalid data can cause any issues.
The debug console has now removed any global background image from its div to always be displayed properly.
id could be set to empty which leads to issues in the Javascript. Not it is mandatory and checked in the administration and in the external workaround.
Changed the demo link from "Use the iframe title for the parent" from the general demo page to the sub demo where it is used.
The style shortcode attribute is now always concatenated with a ;

Advanced Iframe Pro v2026.0

Verified Safe

About Advanced Iframe Pro

Key Features

Best For

Customers Also Installed

Google Places Reviews Pro

Amelia - Enterprise-Level Appointment Booking WordPress Plugin

B2BKing - The Ultimate WooCommerce B2B & Wholesale Plugin

Directories Pro

Ultimate Video Player WordPress Plugin

Element Pack - Addon For Elementor Page Builder Wordpress Plugin

Version Information

Changelog

Brand

Compatibility

Tags

Get this plugin