# Advanced iFrame Pro `meteorgpl-plugin/advanced-iframe-pro` — a WordPress plugin as a Composer package. This plugin includes any web page as shortcode in an advanced iframe or embeds the content directly. - Author: Michael Dempfle — https://www.advanced-iframe.com - Homepage: https://www.advanced-iframe.com - License: not declared - Buy a license from the vendor: https://www.advanced-iframe.com - Page: https://meteorgpl.com/packages/meteorgpl-plugin/advanced-iframe-pro - Requires WordPress: 5.5 - Tested up to WordPress: 7.1.1 - Requires PHP: 7.4 - Translations: cs_CZ, da_DK, de_DE, en_US, es_ES, fr_FR, he_IL, hu_HU, it_IT, ja, nl_NL, ru_RU, ta, zh_CN - Vendor: Michael Dempfle — https://meteorgpl.com/vendors/advanced-iframe.com ## About > **[AI Assistant](https://www.advanced-iframe.com/advanced-iframe-ai-assistant)** > **[Documentation](https://www.advanced-iframe.com/)** > **[Pro demos](https://www.advanced-iframe.com/advanced-iframe/advanced-iframe-pro-demo)** Include content the way YOU like in an iframe that can hide and modify elements, does auto height, forward parameters and does many, many more... = Main features of advanced iframe = By entering the shortcode '[advanced_iframe]' you can include any web page to any page or article. Advanced iFrame now has out of the box support for embedded 3D models using the p3d 3D viewer. Go to https://p3d.in/b/24 and download a pre-configured plugin where the model does scale already nicely on all devices. Get started for free! If you need more storage or access to the Premium features of p3d.in, you can get a 50% discount on your first payment with the coupon AIFRAME on checkout. The following cool features compared to a normal iframe are implemented: - Hide areas of the layout to give the iframe more space (see screenshot) - Show only specific areas of the iframe when the iframe is on a same domain (The Pro version supports this on different domains) or include parts directly by jQuery - Modify css styles in the parent and the iframe to e.g. change the width of the content area (see screen-shot) - Forward parameters to the iframe - Resize the iframe to the content height or width on loading, AJAX or click - Responsive videos (moved from the pro to the the free version in v2022) - Scroll the parent to the top when the iframe is loaded - Hide the content until it is fully loaded - Add a css and js file to the parent page - Security code: You can only insert the shortcode with a valid security code from the administration. - Many additional cool features are available the pro version - see https://www.advanced-iframe.com/advanced-iframe/advanced-iframe-comparison-chart Please note: Modification inside the iframe are only possible if you are on the same domain or use a workaround like described in the settings. So please check first if the iframe page and the parent page are one the same domain. www.example.com and text.example.com are different domains! Please check in the documentation if you can use the feature you like A free iframe checker is available at https://www.advanced-iframe.com/advanced-iframe/free-iframe-checker. This tool does check if a page is allowed to be included! All settings can be set with shortcode attributes as well. If you only use one iframe please use the settings in the administration because there each parameter is explained in detail and also the defaults are set there. = Administration = * Go to Settings -> Advanced iFrame pro = Quick start guide = The quickstart guide is also available as video: https://www.advanced-iframe.com/advanced-iframe/advanced-iframe-video-tutorials To include a webpage to your page please check the following things first: * Check if your page page is allowed to be included https://www.advanced-iframe.com/advanced-iframe/free-iframe-checker! * Check if the iframe page and the parent page are one the same domain. www.example.com and text.example.com are different domains! * Can you modify the page that should be included? Most likely you have one of the following setups: 1. iframe cannot be included: You cannot include the content because the owner does not allow this. 1. iframe can be included and you are on a different domain: See the feature comparison chart: https://www.advanced-iframe.com/advanced-iframe/advanced-iframe-comparison-chart and the feature overview https://www.advanced-iframe.com/advanced-iframe/advanced-iframe-features-availability-overview. To resize the content to the height/width or modify css you need to modify the remote iframe page by adding one line of Javascript to enable the provided workaround. 1. iframe can be included and you are on the same domain: All features of the plugin can be used. If you mix http and https read https://www.advanced-iframe.com/iframe-do-not-mix-http-and-https. Parent https and iframe http does not work on all mayor browsers! ## Changelog ### 2026.3 - New: Added the AI Assistant: https://www.advanced-iframe.com/advanced-iframe-ai-assistant - New: A new template for the pro version was added to enable google analytic tracking in the iframe in js/ai_post_message_converter_google_analytics_template.js. Check the documentation in this file. - New: The active tab is now remembered after a page reload - New: Tested with WordPress 7.1.1 - New: Updated Freemius to v2.13.4 - Fix: Admin styles optimized for WordPress 7 ### 2026.2 - Security fix: additional_js could be used as contributor still in the Gutenberg block. Now also there "Stored Cross-Site Scripting via Gutenberg Block 'additional' Attribute" is closed. See: https://www.cve.org/CVERecord?id=CVE-2026-6742 - New: Tested and optimized for WordPress 7.0 ### 2026.1 - New: Tested with WordPress 6.9.4 - New: Updated Freemius to v2.13.1 ### 2026.0 - Breaking change: Due to the security fix for "Add iframe URL as param" and "Prefix/id/urlrewrite for iframe URL," the hash/hashrewrite needs to be set in both the administration AND the shortcode. - Breaking change: The postMessage send from the iframe is only processed if the feature is enabled. This was added for: "Add iframe URL as param", "Use the iframe title for the parent", "Include content directly from the iframe". Please read the updated documentation. Most users will not have to do anything, because the default way to configure this features by the administration, has not changed. If is only different if you configured them directly in the ai_external.js - Security fix: The feature "Include content directly from the iframe" was accepting any postMessage in the correct structure and adding it to the parent page. Now the feature needs to be enabled and also the input is sanitized by removing all script tags. If you enable this feature only the configured keys are accepted. Make sure that you trust the page you include as you extract content from there! - Security fix: Cross-Site Scripting (XSS) was reported by Patch Stack. The setting additional_height has now XSS detection. The same sanitation was also applied to iframe_zoom and onload_scroll_top. See https://www.wordfence.com/threat-intel/vulnerabilities/id/dcdcb29e-48d0-4e22-8e11-0c76b4355268 and https://patchstack.com/database/Wordpress/Plugin/advanced-iframe/vulnerability/wordpress-advanced-iframe-plugin-2025-10-cross-site-scripting-xss-vulnerability?_s_id=cve - Security fix: Broken Access Control reported by the patch stack has been fixed. There is no official CVE number yet. The URL cache is now a first-in, first-out (FIFO) cache and cannot be fully filled anymore. The cache is now only active if "Add iframe URL as param" with hash/hashrewrite is enabled. The cache size is now shown in the administration, and additional documentation has been added. - Security fix: At hide_part_of_iframe the URL was escaped with esc_html and not esc_url. Now settings like javascript:alert%28document.domain%29 are removed. - New: Tested with WordPress 6.9.1 - New: Tested with PHP 8.5. The entire code was also analyzed with ChatGPT 5.2, which reported no breaking changes. - New: The minimum PHP version has been increased to 7.4. While the plugin itself still works with lower versions, such PHP versions are insecure and should no longer be used! - New: The minimum WordPress version was increased to 5.5. The plugin works with older versions of WordPress, but they are insecure and should not be used. - Fix: user meta and user info data output is using esc_html to avoid that invalid data can cause any issues. - Fix: The debug console has now removed any global background image from its div to always be displayed properly. - Fix: id could be set to empty which leads to issues in the Javascript. Not it is mandatory and checked in the administration and in the external workaround. - Fix: Changed the demo link from "Use the iframe title for the parent" from the general demo page to the sub demo where it is used. - Fix: The style shortcode attribute is now always concatenated with a ; ### 2025.10 - New: Tested with WordPress 6.9 - New: Updated Freemius to v2.13.0 Full changelog: https://meteorgpl.com/packages/meteorgpl-plugin/advanced-iframe-pro/changelog ## Install ```sh composer config repositories.meteorgpl composer https://composer.meteorgpl.com composer require meteorgpl-plugin/advanced-iframe-pro ``` The repository needs a token (see https://meteorgpl.com/docs). The vendor's license checks are intact: activate the plugin in WordPress with a key bought from the vendor. ## Versions No version has been published yet.