Advanced iFrame Pro 2026.3

• New: Added the AI Assistant: https://www.advanced-iframe.com/advanced-iframe-ai-assistant
• New: A new template for the pro version was added to enable google analytic tracking in the iframe in js/ai_post_message_converter_google_analytics_template.js. Check the documentation in this file.
• New: The active tab is now remembered after a page reload
• New: Tested with WordPress 7.1.1
• New: Updated Freemius to v2.13.4
• Fix: Admin styles optimized for WordPress 7

Breaking change: Due to the security fix for "Add iframe URL as param" and "Prefix/id/urlrewrite for iframe URL," the hash/hashrewrite needs to be set in both the administration AND the shortcode.
Breaking change: The postMessage send from the iframe is only processed if the feature is enabled. This was added for: "Add iframe URL as param", "Use the iframe title for the parent", "Include content directly from the iframe". Please read the updated documentation. Most users will not have to do anything, because the default way to configure this features by the administration, has not changed. If is only different if you configured them directly in the ai_external.js
Security fix: The feature "Include content directly from the iframe" was accepting any postMessage in the correct structure and adding it to the parent page. Now the feature needs to be enabled and also the input is sanitized by removing all script tags. If you enable this feature only the configured keys are accepted. Make sure that you trust the page you include as you extract content from there!
Security fix: Cross-Site Scripting (XSS) was reported by Patch Stack. The setting additional_height has now XSS detection. The same sanitation was also applied to iframe_zoom and onload_scroll_top.
Security fix: Broken Access Control reported by the patch stack has been fixed. There is no official CVE number yet. The URL cache is now a first-in, first-out (FIFO) cache and cannot be fully filled anymore. The cache is now only active if "Add iframe URL as param" with hash/hashrewrite is enabled. The cache size is now shown in the administration, and additional documentation has been added.
Security fix: At hide_part_of_iframe the URL was escaped with esc_html and not esc_url. Now settings like javascript:alert%28document.domain%29 are removed.
New: Tested with WordPress 6.9.1
New: Tested with PHP 8.5. The entire code was also analyzed with ChatGPT 5.2, which reported no breaking changes.
New: The minimum PHP version has been increased to 7.4. While the plugin itself still works with lower versions, such PHP versions are insecure and should no longer be used!
New: The minimum WordPress version was increased to 5.5. The plugin works with older versions of WordPress, but they are insecure and should not be used.
Fix: user meta and user info data output is using esc_html to avoid that invalid data can cause any issues.
Fix: The debug console has now removed any global background image from its div to always be displayed properly.
Fix: id could be set to empty which leads to issues in the Javascript. Not it is mandatory and checked in the administration and in the external workaround.
Fix: Changed the demo link from "Use the iframe title for the parent" from the general demo page to the sub demo where it is used.
Fix: The style shortcode attribute is now always concatenated with a ;

- New: Tested with WordPress 6.9
- New: Updated Freemius to v2.13.0

2025.8

2025.7

- Fix: The close icon of show iframe as layer was not shown because of an old path. Now the correct path in the new pro version is used. Show the iframe as layer/popup
- Fix: Some links in the new pro version where still pointing to the old path. They are now working properly.

- Fix: filterBasicXSS could cause a fatal php error with some configurations.

- New: Tested with WordPress 6.5.3
- Fix: When using arrays in the parameters was causing an error. If this is now the case no optimization of placeholders are done anymore.
- Security fix: Added additional filters to some Javascript parameters to increase security.

= 2024.3 =
- Security fix: The filter attribute method now filters shortcode attibutes which are parsed wrong by WordPress if the user does not have the unfiltered_html permission.
- Security fix: #x28 and #x29 are filtered if the user does not have the unfiltered_html permission.

Security fix: The additional_js and additional_js_file_iframe attribute are now only allowed to be used if you have the permission "unfiltered_html", that you need in WordPress to use iframes. If you do not have this permission, during save the attributes are removed and an error message is shown.
Fix: Show iframe as layer was not working properly in Firefox. The link was opening in a new tab. Using a different way to hide the iframe solves the problem.