📧 info@ciso.sa | 📱 +966550939344 | Riyadh, Kingdom of Saudi Arabia
🔧 Scheduled Maintenance — Saturday 2:00-4:00 AM AST. Some features may be temporarily unavailable.    ●   
💎
Pro Plan 50% Off Unlock all AI features, unlimited reports, and priority support. Upgrade
Search Center
ESC to close
Global data_breach Government HIGH 2h Global vulnerability Enterprise Software / ERP Systems CRITICAL 3h Global phishing Cross-sector HIGH 8h Global data_breach Energy CRITICAL 10h Global phishing Government/Multi-sector HIGH 11h Global apt Education CRITICAL 13h Global vulnerability Enterprise Software / ERP Systems CRITICAL 14h Global vulnerability IT Infrastructure CRITICAL 15h Global vulnerability Technology and Software Development HIGH 16h Global vulnerability Enterprise IT and Government CRITICAL 16h Global data_breach Government HIGH 2h Global vulnerability Enterprise Software / ERP Systems CRITICAL 3h Global phishing Cross-sector HIGH 8h Global data_breach Energy CRITICAL 10h Global phishing Government/Multi-sector HIGH 11h Global apt Education CRITICAL 13h Global vulnerability Enterprise Software / ERP Systems CRITICAL 14h Global vulnerability IT Infrastructure CRITICAL 15h Global vulnerability Technology and Software Development HIGH 16h Global vulnerability Enterprise IT and Government CRITICAL 16h Global data_breach Government HIGH 2h Global vulnerability Enterprise Software / ERP Systems CRITICAL 3h Global phishing Cross-sector HIGH 8h Global data_breach Energy CRITICAL 10h Global phishing Government/Multi-sector HIGH 11h Global apt Education CRITICAL 13h Global vulnerability Enterprise Software / ERP Systems CRITICAL 14h Global vulnerability IT Infrastructure CRITICAL 15h Global vulnerability Technology and Software Development HIGH 16h Global vulnerability Enterprise IT and Government CRITICAL 16h
Vulnerabilities

CVE-2026-3516

Medium
The Contact List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_cl_map_iframe' parameter in all versions up to, and including, 3.0.18. This is due to insufficient input sa
CWE-79 — Weakness Type
Published: Mar 21, 2026  ·  Modified: Mar 23, 2026  ·  Source: NVD
CVSS v3
6.4
🔗 NVD Official
📄 Description (English)

The Contact List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_cl_map_iframe' parameter in all versions up to, and including, 3.0.18. This is due to insufficient input sanitization and output escaping when handling the Google Maps iframe custom field. The saveCustomFields() function in class-contact-list-custom-fields.php uses a regex to extract <iframe> tags from user input but does not validate or sanitize the iframe's attributes, allowing event handlers like 'onload' to be included. The extracted iframe HTML is stored via update_post_meta() and later rendered on the front-end in class-cl-public-card.php without any escaping or wp_kses filtering. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

🤖 AI Executive Summary

The Contact List WordPress plugin versions up to 3.0.18 contains a Stored Cross-Site Scripting vulnerability in the Google Maps iframe custom field that allows authenticated attackers to inject malicious scripts. Attackers with Contributor-level access can exploit insufficient input sanitization to execute arbitrary JavaScript when users view affected pages.

📄 Description (Arabic)

ثغرة XSS مخزنة في إضافة Contact List للـ WordPress تؤثر على جميع الإصدارات حتى 3.0.18 عبر معامل '_cl_map_iframe' المستخدم لحقل خريطة Google المخصص. تحدث الثغرة بسبب عدم كفاية تنظيف المدخلات والتحقق من صحة سمات iframe، مما يسمح بإدراج معالجات أحداث ضارة مثل 'onload'. يمكن للمهاجمين المصرحين بمستوى المساهم أو أعلى تنفيذ أكواد JavaScript عشوائية عند وصول المستخدمين للصفحات المصابة.

🤖 ملخص تنفيذي (AI)

The Contact List WordPress plugin versions up to 3.0.18 contains a Stored Cross-Site Scripting vulnerability in the Google Maps iframe custom field that allows authenticated attackers to inject malicious scripts. Attackers with Contributor-level access can exploit insufficient input sanitization to execute arbitrary JavaScript when users view affected pages.

🤖 AI Intelligence Analysis Analyzed: May 14, 2026 03:21
🇸🇦 Saudi Arabia Impact Assessment
Saudi Relevance: high
🏢 Affected Saudi Sectors
government banking healthcare
🎯 MITRE ATT&CK Techniques
⚖️ Saudi Risk Score (AI)
6.0
/ 10.0
🔧 Remediation Steps (English)
Update the Contact List plugin to version 3.0.19 or later immediately. Implement strict input validation and sanitization for the '_cl_map_iframe' parameter. Apply WordPress security functions like wp_kses_post() for output escaping. Restrict Contributor-level permissions to trusted users only. Conduct security audit of custom field handling in the plugin.
🔧 خطوات المعالجة (العربية)
قم بتحديث إضافة Contact List إلى الإصدار 3.0.19 أو أحدث فوراً. طبق التحقق الصارم من صحة المدخلات وتنظيفها لمعامل '_cl_map_iframe'. استخدم وظائف أمان WordPress مثل wp_kses_post() لتجنب الإخراج. قيد صلاحيات مستوى المساهم للمستخدمين الموثوقين فقط. أجرِ تدقيق أمني لمعالجة الحقول المخصصة في الإضافة.
📋 Regulatory Compliance Mapping
🟢 NCA ECC 2024
5.1.1 5.2.1 5.2.2
🔵 SAMA CSF
CC6.1 CC6.2 CC7.2
🟡 ISO 27001:2022
A.14.2.1 A.14.2.5
📊 CVSS Score
6.4
/ 10.0 — Medium
📊 CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Attack VectorN — None / Network
Attack ComplexityL — Low / Local
Privileges RequiredL — Low / Local
User InteractionN — None / Network
ScopeC — Changed
ConfidentialityL — Low / Local
IntegrityL — Low / Local
AvailabilityN — None / Network
📋 Quick Facts
Severity Medium
CVSS Score6.4
CWECWE-79
Exploit No
Patch ✗ No
Published 2026-03-21
Source Feed nvd
Views 4
🇸🇦 Saudi Risk Score
6.0
/ 10.0 — Saudi Risk
Priority: MEDIUM
🏷️ Tags
CWE-79
Share this CVE
📣 Found this valuable?
Share it with your cybersecurity network
in LinkedIn 𝕏 X / Twitter 💬 WhatsApp ✈ Telegram
🍪 Privacy Preferences
CISO Consulting — Compliant with Saudi Personal Data Protection Law (PDPL)
We use cookies and similar technologies to provide the best experience on our platform. You can choose which types you accept.
🔒
Essential Always On
Required for the website to function properly. Cannot be disabled.
📋 Sessions, CSRF tokens, authentication, language preferences
📊
Analytics
Help us understand how visitors use the site and improve performance.
📋 Page views, session duration, traffic sources, performance metrics
⚙️
Functional
Enable enhanced features like content personalization and preferences.
📋 Dark/light theme, font size, custom dashboards, saved filters
📣
Marketing
Used to deliver content and ads relevant to your interests.
📋 Campaign tracking, retargeting, social media analytics
Privacy Policy →
CISO AI Assistant
Ask anything · Documents · Support
🔐

Introduce Yourself

Enter your details to access the full assistant

Your info is private and never shared
💬
CyberAssist
Online · responds in seconds
5 / 5
🔐 Verify Your Identity

Enter your email to receive a verification code before submitting a support request.

Enter to send · / for commands 0 / 2000
CISO AI · Powered by Anthropic Claude
✦ Quick Survey Help Us Improve CISO Consulting Your feedback shapes the future of our platform — takes less than 2 minutes.
⚠ Please answer this question to continue

How would you rate your overall experience with our platform?

Rate from 1 (poor) to 5 (excellent)

🎉
Thank you!
Your response has been recorded.