Stored Cross-Site Scripting in Contact List Plugin for WordPress

CVE-2026-3516

What is CVE-2026-3516?

The Contact List plugin for WordPress is vulnerable to Stored Cross-Site Scripting through the '_cl_map_iframe' parameter. This vulnerability exists due to inadequate input sanitization and output escaping routines, specifically in the handling of the Google Maps iframe custom field. The saveCustomFields() function employs regex to extract tags but fails to validate the iframe's attributes, enabling the inclusion of unsafe event handlers like 'onload'. The stored iframe HTML is then displayed on the front-end without proper sanitization or wp_kses filtering. As a result, authenticated attackers with Contributor-level access or higher can inject malicious scripts that execute whenever users visit affected pages.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References