d3kc4rt1/CVE-2026-3516

GitHubRepository PoCWriteup

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A technical writeup describing a stored XSS vulnerability (CVE-2026-3516) in the Contact List WordPress plugin. It explains the root cause, provides exploitation steps and an example HTTP request, but contains no executable exploit or scanner code.

Backdoor review

No backdoor observed in reviewed code

The repository contains only a single README.md file that documents a known Stored XSS vulnerability (CVE-2026-3516) in the Contact List WordPress plugin. The text describes the vulnerability, its root cause, exploitation steps, and remediation. No executable code, obfuscated payloads, or concealed backdoor behavior is present. The PoC steps describe standard XSS exploitation using an onload event handler, which is consistent with the disclosed vulnerability and does not indicate hidden malicious functionality targeting the person running the PoC.

ClassificationWriteup
Model confidence100%
AuthenticationRequired
Languagesmarkdown
Target softwareContact List WordPress plugin
Attack typesstored cross-site scripting
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a README.md file containing a vulnerability description, root cause analysis, and manual exploitation steps. It does not include any executable code, script, or automated tool. The analysis_routing classification is NO_POC_CODE_IDENTIFIED, and the content is purely a technical writeup.

README.md:1-72

Requirements

  • WordPress with Contact List (<= 3.0.17) installedREADME.md:35
  • A published page containing the [contact_list] shortcodeREADME.md:36
  • Attacker logged in with an Author accountREADME.md:37

Observed behavior

  • Describes how to inject a malicious iframe via the _cl_map_iframe parameter in a POST request to store an XSS payloadREADME.md:44-46
  • Explains that visiting the public directory page triggers the stored XSS payloadREADME.md:47
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Description
CVE-2026-3516 Stored XSS via _cl_map_iframe parameterThe README documents a legitimate vulnerability with a standard XSS payload; no backdoor or deceptive payload is included.README.md:1-72
Review boundaries

What the analysis did not establish

  • Only one file (README.md) is provided; no source code or exploit scripts are included.
  • The artifact is a static description; no dynamic behavior can be observed.
  • Only the README.md file was reviewed; no other files exist in the repository snapshot. The analysis is limited to the supplied text content and does not verify the actual plugin code or the described vulnerability.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1