CVE-2026-3516: Contact List Plugin for WordPress XSS Flaw

CVE-2026-3516 Overview

The Contact List plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the _cl_map_iframe parameter in all versions up to and including 3.0.18. This vulnerability arises from insufficient input sanitization and output escaping when handling the Google Maps iframe custom field. Authenticated attackers with Contributor-level access or above can inject arbitrary web scripts that execute whenever a user accesses an affected page.

Critical Impact

Authenticated attackers can inject persistent malicious scripts that execute in the context of victim browsers, potentially leading to session hijacking, credential theft, or further compromise of WordPress administrator accounts.

Affected Products

• Contact List WordPress Plugin versions up to and including 3.0.18
• WordPress installations with Contact List plugin enabled
• Sites allowing Contributor-level or above user registrations

Discovery Timeline

• 2026-03-21 - CVE CVE-2026-3516 published to NVD
• 2026-03-23 - Last updated in NVD database

Technical Details for CVE-2026-3516

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability exists in the Contact List plugin's handling of Google Maps iframe input. The saveCustomFields() function in class-contact-list-custom-fields.php uses a regular expression to extract <iframe> tags from user input, but critically fails to validate or sanitize the iframe's attributes. This allows attackers to include malicious event handlers such as onload, onerror, or onmouseover within the iframe tag.

The extracted iframe HTML is then stored directly to the WordPress database via update_post_meta() without proper sanitization. When the data is retrieved and rendered on the front-end through class-cl-public-card.php, no escaping or wp_kses filtering is applied, resulting in the injected script executing in the browser context of any user viewing the page.

Root Cause

The root cause is a failure to properly sanitize user-supplied iframe input at two critical points:

1. Input Validation Failure: The saveCustomFields() function at line 675 in class-contact-list-custom-fields.php extracts iframe content using regex without validating or stripping dangerous attributes and event handlers.

2. Output Escaping Failure: The rendering function in class-cl-public-card.php at line 466 outputs the stored iframe HTML directly without applying WordPress escaping functions (esc_html(), esc_attr()) or allowlist filtering via wp_kses().

Attack Vector

The attack vector is network-based and requires authenticated access at Contributor level or above. An attacker can exploit this vulnerability through the following mechanism:

1. The attacker authenticates to WordPress with Contributor-level privileges
2. They create or edit a contact entry and inject a malicious payload in the Google Maps iframe field
3. The payload includes JavaScript event handlers embedded within the iframe tag attributes
4. When any user (including administrators) views the contact page, the malicious script executes in their browser session

The vulnerability can be exploited by crafting an iframe with embedded JavaScript event handlers. For example, an attacker might include an onload attribute containing malicious JavaScript within the iframe tag. When stored and rendered without sanitization, this script executes automatically when the page loads. See the Wordfence Vulnerability Report for additional technical details.

Detection Methods for CVE-2026-3516

Indicators of Compromise

• Presence of unusual JavaScript event handlers (onload, onerror, onmouseover) in iframe tags within postmeta database entries for _cl_map_iframe
• Unexpected script execution or browser alerts when viewing Contact List plugin pages
• Suspicious network requests originating from contact list pages to unknown external domains

Detection Strategies

• Monitor WordPress postmeta table for entries containing _cl_map_iframe with JavaScript event handlers or javascript: URIs
• Implement Web Application Firewall (WAF) rules to detect iframe tags containing event handler attributes in POST requests to WordPress admin endpoints
• Review user activity logs for Contributor-level accounts creating or modifying contact entries with suspicious iframe content

Monitoring Recommendations

• Enable WordPress audit logging to track all changes to Contact List entries
• Configure browser Content Security Policy (CSP) headers to prevent inline script execution
• Regularly scan database content for stored XSS patterns using security plugins

How to Mitigate CVE-2026-3516

Immediate Actions Required

• Update the Contact List plugin to a version newer than 3.0.18 immediately
• Audit existing Contact List entries for malicious iframe content in the _cl_map_iframe field
• Review WordPress user accounts and remove unnecessary Contributor-level access
• Implement Content Security Policy headers to mitigate XSS impact

Patch Information

The vulnerability has been addressed in WordPress Changeset #3486445. Site administrators should update to the patched version through the WordPress admin dashboard or by downloading the latest version from the WordPress plugin repository. The patch implements proper sanitization of iframe attributes and adds appropriate output escaping.

Workarounds

• Temporarily disable the Contact List plugin until the update can be applied
• Restrict user registration and remove Contributor-level access from untrusted users
• Implement a Web Application Firewall rule to block iframe submissions containing event handler attributes

# Configuration example - WordPress wp-config.php CSP headers
# Add to wp-config.php or .htaccess to mitigate XSS impact
# Note: This is a mitigation, not a fix - update the plugin

# For Apache (.htaccess):
# Header set Content-Security-Policy "default-src 'self'; script-src 'self'; frame-src 'self' https://www.google.com https://maps.google.com;"

# For Nginx (add to server block):
# add_header Content-Security-Policy "default-src 'self'; script-src 'self'; frame-src 'self' https://www.google.com https://maps.google.com;";