Advanced iFrame
Include content the way YOU like in an iframe that can hide and modify elements, does auto-height, forward parameters and does many, many more...
4.3(55 reviews)
·40K+ active installs·Updated 4 weeks agoAs of April 2026, Advanced iFrame is a WordPress embed plugin with 40K+ active installations and a 4.3/5 rating from 55 reviews. It has been downloaded 2.4M+ times in total. Requires WordPress 5.5+ and PHP 7.4+. Available on WordPress.org since 2011. Actively maintained — updated within the last month. Download volume is stable this week. Support resolution rate: 100%. Top alternative: EmbedPress – PDF Embedder, Embed….
4.3/555 reviews
40K+active installs
100%resolved
15 yearssince 2011
Overview
Include content the way YOU like in an iframe that can hide and modify elements, does auto height, forward parameters and does many, many more…
Main features of advanced iframe
By entering the shortcode ‘[advanced_iframe]’ you can include any webpage to any page or article.
Advanced iFrame now has out of the box support for embedded 3D models using the p3d 3D viewer. Go to https://p3d.in/b/24 and download a pre-configured plugin where the model does scale already nicely on all devices. Get started for free! If you need more storage or access to the Premium features of p3d.in, you can get a 50% discount on your first payment with the coupon AIFRAME on checkout.
The following cool features compared to a normal iframe are implemente…
Screenshots
Ratings & Reviews
4.355 reviews
5 ★
45
4 ★
1
3 ★
0
2 ★
1
1 ★
8
Recent Reviews
Horrible, invasive, clunky
by Toine Rademacher·1 month ago·1 reply
What a horrible, clunky, and invasive plugin. Every wp-admin page refresh I get an admin notice that takes up half my screen and after a few seconds gets smaller with a weird animation. To get this notice gone, I have to opt in and share my data???? This is what it says:
OPT-IN to get email notifications for security & feature updates and occasional offers. If you OPT-IN you will additionally get:
- Automatic removal of the small notice which is shown on the iframe
- Boxes in the administration remembers their state
- Additional sections on the help tab
- Exclusive coupons
Isn’t this all against the WP.org policy? Stop irritating users just for them to share their data and for you to send marketing messages!!!
Just what we needed
·4 months ago
Fast to install and grasp. Feature rich = future proof. We’re happy.
Excellent and can’t do without
by Don Brady·9 months ago
Used extensively with other apps in domain without hiccup. Been using for years and will continue to do so.
Awesome plug-in
by oneredball·1 year ago·1 reply
Michael you made me save tons of time, thank you so much.
- This topic was modified 1 year, 9 months ago by oneredball.
very good!
by sempervirentz·2 years ago
embedded a python flask app with this plugin. Saved me so much work. Great plugin!
Download Trends
Today: 335Yesterday: 397This week: 2KPeriod total: 356K
Compatibility
| WordPress | 5.5+ requiredTested up to 6.9.4 |
| PHP | 7.4+ required |
Version Adoption
Other
43.1%
v2026.0
38.5%
v2025.10
10.5%
v2024.5
7.9%
Top Alternatives to Advanced iFrame
Frequently Asked Questions
Changelog
2026.0
- Breaking change: Due to the security fix for “Add iframe URL as param” and “Prefix/id/urlrewrite for iframe URL,” the hash/hashrewrite needs to be set in both the administration AND the shortcode.
- Breaking change: The postMessage send from the iframe is only processed if the feature is enabled. This was added for: “Add iframe URL as param”, “Use the iframe title for the parent”, “Include content directly from the iframe”. Please read the updated documentation. Most users will not have to do anything, because the default way to configure this features by the administration, has not changed. If is only different if you configured them directly in the ai_external.js
- Security fix: The feature “Include content directly from the iframe” was accepting any postMessage in the correct structure and adding it to the parent page. Now the feature needs to be enabled and also the input is sanitized by removing all script tags. If you enable this feature only the configured keys are accepted. Make sure that you trust the page you include as you extract content from there!
- Security fix: Cross-Site Scripting (XSS) was reported by Patch Stack. The setting additional_height has now XSS detection. The same sanitation was also applied to iframe_zoom and onload_scroll_top. See https://www.wordfence.com/threat-intel/vulnerabilities/id/dcdcb29e-48d0-4e22-8e11-0c76b4355268 and https://patchstack.com/database/Wordpress/Plugin/advanced-iframe/vulnerability/wordpress-advanced-iframe-plugin-2025-10-cross-site-scripting-xss-vulnerability?_s_id=cve
- Security fix: Broken Access Control reported by the patch stack has been fixed. There is no official CVE number yet. The URL cache is now a first-in, first-out (FIFO) cache and cannot be fully filled anymore. The cache is now only active if “Add iframe URL as param” with hash/hashrewrite is enabled. The cache size is now shown in the administration, and additional documentation has been added.
…and 10 more changes
Contributors
Plugin data sourced from WordPress.org. Analysis and metrics by PluginSift.