d3kc4rt1/cve-2026-3516Authenticated Stored Cross-Site Scripting (XSS) in Contact List Plugin
Disclaimer: This repository is created for educational purposes and ethical disclosure only. The vulnerability has been responsibly reported to the vendor and patched. Do not use this information to exploit systems without proper authorization.
A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Contact List - Online Staff Directory & Address Book plugin for WordPress (versions <= 3.0.17). This vulnerability allows authenticated users with Author privileges or higher the inject malicious JavaScript into contact cards via a hidden custom field.
When the contact card is rendered on the public-facing directory, the injected payload executes in the browser of any visitor. If an Administrator views the page, this flaw can be escalated to full Account Takeover (ATO) and site compromise.
<= 3.0.17The vulnerability stems from improper sanitization and unsafe output handling of the _cl_map_iframe custom field, which is intended to embed map iframes.
1. Insecure Data Storage:
In includes/class-contact-list-custom-fields.php (inside saveCustomFields()), the plugin processes the _cl_map_iframe input using a regular expression to extract an ```
6. Forward the request. The server stores the malicious iframe.
7. Trigger: Visit the public directory page where [contact_list] is embedded. The alert box will trigger immediately, confirming code execution.
POST /wp-admin/post.php HTTP/1.1
Host: TARGET
Content-Type: application/x-www-form-urlencoded
Cookie: [Author_Session_Cookies]
post_title=Hacked+Contact&post_type=contact&action=editpost&_cl_map_iframe=
To patch this vulnerability, the plugin developers must:
wp_kses() with a strict array of allowed HTML tags and attributes when saving _cl_map_iframe. Disallow attributes like onload, onerror, or javascript: URIs.