iframe

82 Quality Score

Active Installs

21/30

With 70,000 active installs and a popularity score above the cap at 72/30, the plugin has meaningful traction, though it sits well behind the category leaders like WP Go Maps at 300,000 installs.

Update Freshness

25/25

The maintenance score is a perfect 100/25, supported by an update on 2026-05-17 and tested against WordPress 7.0, which signals an actively maintained codebase.

User Rating

13/15

The 88/100 rating from 56 reviewers is solid and indicates most users are happy with the simple, predictable behaviour.

Support Health

8/15

Support health sits at 50/15 because there is only 1 support thread and 0% are resolved, so although it scores adequately, there is essentially no public track record of help.

WP Compatibility

15/15

A full 100/15 compatibility score comes from declared support back to WordPress 3.0 and verified testing on 7.0, though no minimum PHP version is listed which is a minor transparency gap.

Scores higher than 88% of indexed plugins

About

[iframe src="http://www.youtube.com/embed/7_nAZQt9qu0" width="100%" height="500"] shortcode

Active Installs 60k+

Rating ★★★★ 4.4/5

Last Updated 2026-05-17 2:17am GMT

Requires WordPress 3.0+

Tested Up To 7.0.4

Security History

7 known vulnerabilities, all patched

7 Medium

Most recent: May 22, 2024

View details ▸

iframe <= 5.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode Medium

May 22, 2024 Patched in ["5.1"] CVE-2023-6844

iframe <= 5.0 - Authenticated (Contributor+ Stored Cross-Site Scripting Medium

May 14, 2024 Patched in ["5.1"] CVE-2024-34805

iFrame <= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via srcdoc Medium

December 28, 2023 Patched in ["4.9"] CVE-2023-52125

iframe <= 4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'iframe' Shortcode Medium

September 25, 2023 Patched in ["4.7"] CVE-2023-4919

iframe <= 4.4 - Authenticated Stored Cross Site Scripting Medium

May 7, 2020 Patched in ["4.5"] CVE-2020-12696

iFrame <= 3.0 - Reflected Cross-Site Scripting Medium

August 11, 2015 Patched in ["4.0"] CVE-2015-6738

iFrame <= 4.0 - Stored Cross-Site Scripting Medium

August 10, 2015 Patched in ["4.1"] CVE-2015-6738

What It Does

The iframe plugin adds a simple [iframe] shortcode to WordPress that lets you embed external content like YouTube videos, Vimeo clips, and Google Maps by URL, width, and height. It does not provide lazy loading, facades, or privacy enhancements, so the embedded page loads directly inside an iframe on the front end. Functionally it is a wrapper around the native HTML iframe tag, exposed through WordPress's shortcode API.

Who It's For

This plugin suits site owners who want a quick, lightweight way to drop a YouTube or Google Maps embed into a page without touching the code editor. It works well for small content teams, travel blogs, real estate listings, or educational sites that just need a plain iframe wrapper. Developers who prefer the built-in WordPress block editor and the native Embed block should likely not bother installing it.

Who Should Skip It

If you need lazy loading, facades for performance, GDPR-friendly YouTube embeds, or any analytics on embedded videos, skip this plugin and use EmbedPress, Presto Player, or Embed Plus for YouTube instead. Anyone happy with the default Embed block in the Gutenberg editor also does not need this.

The Bottom Line

The iframe plugin is a tidy, well maintained utility that does exactly one job: wrap an iframe in a shortcode, and it earns an 82.4/100 quality score for doing it well. It is best suited to simple, low-stakes embed needs rather than performance critical or privacy sensitive sites. For anything beyond a basic embed, the alternatives above are stronger picks.

Pick this when you need full interactive maps with markers, directions, and custom layers rather than a single static iframe.

Feeds for YouTube 85/100

Choose this when you want to pull an entire YouTube channel, playlist, or live stream into a gallery layout rather than embed one video at a time.

EmbedPress 84/100

Go with EmbedPress if you need embeds beyond simple iframes, including PDFs, Google Docs, 3D flipbooks, and YouTube privacy modes.

Presto Player 84/100

Pick Presto Player when you self-host video files, want advanced player controls, analytics, and adaptive bitrate streaming.

Embed Plus for YouTube Gallery, Livestream and Lazy Loading with Facades 84/100

Choose this when YouTube specifically is your priority and you need galleries, lazy loading with facades for page speed, and live stream support.