Advanced iFrame Pro is a powerful tool that lets you easily embed content from other sites directly into your own web pages.
By using Advanced iFrame Pro, you can maintain control over how embedded content appears, behaves, and interacts within your site environment.
This flexibility ensures that your embedded content feels like a natural extension of your website, preserving branding consistency and professional quality.
By using Advanced iFrame Pro, you can maintain control over how embedded content appears, behaves, and interacts within your site environment.
This flexibility ensures that your embedded content feels like a natural extension of your website, preserving branding consistency and professional quality.
- Lazy Loading – Improves page load times by loading iframe content only when it enters the viewport, enhancing website performance and user experience.
- Responsive Design – Ensures that embedded content automatically adapts to different screen sizes and devices for flawless display across desktops, tablets, and mobiles.
- Custom CSS Injection – Allows you to apply personalized styling directly to the iframe content, ensuring seamless visual integration with your site’s design language.
- Cross-Domain Communication – Enables secure interaction between your website and the embedded iframe content, facilitating advanced functionality like form submissions or dynamic data updates.
- Advanced Security Controls – Includes features such as URL restriction and HTTPS support to protect your site and visitors when embedding third-party content.
- SEO Optimization Tools – Helps mitigate SEO challenges associated with iframes by enabling content previews and metadata configurations.
- Dynamic Sizing Options – Automatically adjusts iframe height and width based on the embedded content to eliminate scrollbars and improve aesthetics.
- Easy Shortcode Integration – Simplifies embedding processes with easy-to-use shortcodes compatible with popular CMS platforms, saving development time.
- Support for Video and Interactive Content – Perfect for embedding engaging multimedia such as videos, live streams, and interactive maps with smooth playback and interaction.
Why choose NulledFire?
- ✅ Original GPL files
- 🛡️ Malware scanned
- 🔄 Updated daily
- 🌐 Unlimited websites
- 🔔 Email notifications
- 🚀 Fast CDN download
What's new in Version 2026.3
- New: Added the AI Assistant:
https://www.advanced-iframe.com/advanced-iframe-ai-assistant - New: A new template for the pro version was added to enable google analytic tracking in the iframe in js/ai_post_message_converter_google_analytics_template.js. Check the documentation in this file.
- New: The active tab is now remembered after a page reload
- New: Tested with WordPress 7.1.1
- New: Updated Freemius to v2.13.4
- Fix: Admin styles optimized for WordPress 7
What's new in Version 2026.0
Breaking change: Due to the security fix for "Add iframe URL as param" and "Prefix/id/urlrewrite for iframe URL," the hash/hashrewrite needs to be set in both the administration AND the shortcode.
Breaking change: The postMessage send from the iframe is only processed if the feature is enabled. This was added for: "Add iframe URL as param", "Use the iframe title for the parent", "Include content directly from the iframe". Please read the updated documentation. Most users will not have to do anything, because the default way to configure this features by the administration, has not changed. If is only different if you configured them directly in the ai_external.js
Security fix: The feature "Include content directly from the iframe" was accepting any postMessage in the correct structure and adding it to the parent page. Now the feature needs to be enabled and also the input is sanitized by removing all script tags. If you enable this feature only the configured keys are accepted. Make sure that you trust the page you include as you extract content from there!
Security fix: Cross-Site Scripting (XSS) was reported by Patch Stack. The setting additional_height has now XSS detection. The same sanitation was also applied to iframe_zoom and onload_scroll_top.
Security fix: Broken Access Control reported by the patch stack has been fixed. There is no official CVE number yet. The URL cache is now a first-in, first-out (FIFO) cache and cannot be fully filled anymore. The cache is now only active if "Add iframe URL as param" with hash/hashrewrite is enabled. The cache size is now shown in the administration, and additional documentation has been added.
Security fix: At hide_part_of_iframe the URL was escaped with esc_html and not esc_url. Now settings like javascript:alert%28document.domain%29 are removed.
New: Tested with WordPress 6.9.1
New: Tested with PHP 8.5. The entire code was also analyzed with ChatGPT 5.2, which reported no breaking changes.
New: The minimum PHP version has been increased to 7.4. While the plugin itself still works with lower versions, such PHP versions are insecure and should no longer be used!
New: The minimum WordPress version was increased to 5.5. The plugin works with older versions of WordPress, but they are insecure and should not be used.
Fix: user meta and user info data output is using esc_html to avoid that invalid data can cause any issues.
Fix: The debug console has now removed any global background image from its div to always be displayed properly.
Fix: id could be set to empty which leads to issues in the Javascript. Not it is mandatory and checked in the administration and in the external workaround.
Fix: Changed the demo link from "Use the iframe title for the parent" from the general demo page to the sub demo where it is used.
Fix: The style shortcode attribute is now always concatenated with a ;
Breaking change: The postMessage send from the iframe is only processed if the feature is enabled. This was added for: "Add iframe URL as param", "Use the iframe title for the parent", "Include content directly from the iframe". Please read the updated documentation. Most users will not have to do anything, because the default way to configure this features by the administration, has not changed. If is only different if you configured them directly in the ai_external.js
Security fix: The feature "Include content directly from the iframe" was accepting any postMessage in the correct structure and adding it to the parent page. Now the feature needs to be enabled and also the input is sanitized by removing all script tags. If you enable this feature only the configured keys are accepted. Make sure that you trust the page you include as you extract content from there!
Security fix: Cross-Site Scripting (XSS) was reported by Patch Stack. The setting additional_height has now XSS detection. The same sanitation was also applied to iframe_zoom and onload_scroll_top.
Security fix: Broken Access Control reported by the patch stack has been fixed. There is no official CVE number yet. The URL cache is now a first-in, first-out (FIFO) cache and cannot be fully filled anymore. The cache is now only active if "Add iframe URL as param" with hash/hashrewrite is enabled. The cache size is now shown in the administration, and additional documentation has been added.
Security fix: At hide_part_of_iframe the URL was escaped with esc_html and not esc_url. Now settings like javascript:alert%28document.domain%29 are removed.
New: Tested with WordPress 6.9.1
New: Tested with PHP 8.5. The entire code was also analyzed with ChatGPT 5.2, which reported no breaking changes.
New: The minimum PHP version has been increased to 7.4. While the plugin itself still works with lower versions, such PHP versions are insecure and should no longer be used!
New: The minimum WordPress version was increased to 5.5. The plugin works with older versions of WordPress, but they are insecure and should not be used.
Fix: user meta and user info data output is using esc_html to avoid that invalid data can cause any issues.
Fix: The debug console has now removed any global background image from its div to always be displayed properly.
Fix: id could be set to empty which leads to issues in the Javascript. Not it is mandatory and checked in the administration and in the external workaround.
Fix: Changed the demo link from "Use the iframe title for the parent" from the general demo page to the sub demo where it is used.
Fix: The style shortcode attribute is now always concatenated with a ;
- Tags
- codecanyon
