What is the CVSS score of EUVD-2026-13922?

EUVD-2026-13922 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by EUVD-2026-13922?

Organizations using all should be aware of moderate risk from CVE-2026-3516, a cross-site scripting vulnerability rated CVSS 6.4.

How to fix or mitigate EUVD-2026-13922?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

PHP EUVD-2026-13922

| CVE-2026-3516 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-20 Wordfence

GHSA-9mgv-v56m-vc43

WordPress PHP XSS Google

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 20, 2026 - 23:46 euvd

EUVD-2026-13922

Analysis Generated

Mar 20, 2026 - 23:46 vuln.today

CVE Published

Mar 20, 2026 - 23:25 nvd

MEDIUM 6.4

DescriptionCVE.org

The Contact List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_cl_map_iframe' parameter in all versions up to, and including, 3.0.18. This is due to insufficient input sanitization and output escaping when handling the Google Maps iframe custom field. The saveCustomFields() function in class-contact-list-custom-fields.php uses a regex to extract <iframe> tags from user input but does not validate or sanitize the iframe's attributes, allowing event handlers like 'onload' to be included. The extracted iframe HTML is stored via update_post_meta() and later rendered on the front-end in class-cl-public-card.php without any escaping or wp_kses filtering. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

A Stored Cross-Site Scripting (XSS) vulnerability exists in the Contact List plugin for WordPress (versions up to 3.0.18) where the '_cl_map_iframe' parameter fails to properly sanitize and escape Google Maps iframe custom fields, allowing authenticated attackers with Contributor-level access or higher to inject arbitrary JavaScript that executes in the browsers of users viewing affected pages. The vulnerability stems from insufficient input validation in the saveCustomFields() function and missing output escaping in the front-end rendering, creating a persistent XSS condition with a CVSS score of 6.4 and low-to-moderate exploitation probability given the authentication requirement.

Technical ContextAI

The vulnerability exists within the Contact List – Online Staff Directory & Address Book plugin (CPE: cpe:2.3:a:anssilaitila:contact_list_–_online_staff_directory_&_address_book:*:*:*:*:*:*:*:*) for WordPress. The root cause is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation) and involves two distinct security failures in the PHP codebase: first, the saveCustomFields() function in class-contact-list-custom-fields.php uses a regex pattern to extract iframe tags from user input but performs no attribute validation, allowing malicious event handlers (such as 'onload', 'onerror', etc.) to be embedded within iframe attributes; second, the extracted iframe HTML is stored directly via WordPress's update_post_meta() function without sanitization, and subsequently rendered in class-cl-public-card.php without applying wp_kses() filtering or output escaping functions like wp_kses_post(). This combination creates a stored XSS vector where unsanitized HTML persists in the database and executes unfiltered in user browsers.

RemediationAI

Immediately upgrade the Contact List plugin to a patched version beyond 3.0.18, which should include input sanitization in the saveCustomFields() function and proper output escaping via wp_kses_post() or equivalent WordPress sanitization functions in the front-end rendering code (class-cl-public-card.php). Consult the plugin's changelog and the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/a8059995-55cb-49ee-add1-f5364d0772eb) for the specific patched version number and installation instructions. As an interim measure while awaiting or implementing patches, restrict the Contributor and Editor user role to trusted personnel only, regularly audit user accounts for unauthorized privilege escalation, and consider implementing Web Application Firewall (WAF) rules to filter iframe tags with event handlers from user submissions. Additionally, review all existing Contact List custom fields for suspicious iframe content that may have been previously injected, and use WordPress post meta cleanup tools to sanitize or remove compromised data before patching.