The Contact List plugin for WordPress can store malicious JavaScript when an authenticated user with Contributor level or higher edits the _cl_map_iframe field. The plugin extracts an iframe tag but does not sanitize its attributes, and later displays the stored iframe unescaped. This flaw permits attackers to embed event handlers such as onload, enabling the execution of arbitrary scripts whenever a visitor loads a contact card, potentially enabling defacement, credential theft, or further XSS attacks.

WordPress sites that have installed the Contact List – Online Staff Directory & Address Book plugin version 3.0.18 or earlier are affected. The vulnerability exists in all releases up to and including 3.0.18 across the plugin’s author anssilaitila.

The CVSS base score of 6.4 indicates moderate severity. Exploitation requires Contributor‑level or higher access within the WordPress dashboard, and occurs via the normal custom field editing interface. No EPSS score is available and the issue is not listed in the CISA KEV catalog. Because this is a stored XSS flaw, a compromised or malicious user can persistently inject code that runs for every visitor, affecting the entire front‑end and potentially compromising logged‑in sessions.