The Contact List – Online Staff Directory & Address Book WordPress plugin suffers from a stored XSS vulnerability due to insufficient input sanitization and output escaping of the '_cl_map_iframe' parameter. The saveCustomFields() function uses a regex to extract iframe tags but does not sanitize iframe attributes, allowing injection of event handlers like 'onload'. The iframe HTML is stored via update_post_meta() and rendered without escaping or filtering, enabling authenticated attackers with Contributor-level permissions or higher to inject arbitrary JavaScript that executes in users' browsers when viewing the affected pages.

An attacker with Contributor-level or higher privileges can inject malicious JavaScript code into pages via the vulnerable iframe parameter. This code executes in the context of users visiting the infected pages, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability does not affect availability but impacts confidentiality and integrity of user sessions and data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict Contributor-level access to trusted users only and consider disabling or removing the Contact List plugin if possible. Monitor for plugin updates from the vendor that address this vulnerability and apply official fixes promptly once released.