Incident response checklist (if you suspect compromise)

1. Contain
   • Apply blocking rules for the offending parameter.
   • Temporarily set the site to maintenance mode if needed.
   • Disable the affected plugin if it is safe to do so.
2. Preserve evidence
   • Collect database exports, webserver logs, and plugin configuration snapshots.
   • Do not purge logs before forensic analysis.
3. Eradicate
   • Remove injected content from the database after capturing evidence.
   • Scan and clean files; replace infected files with clean copies from trusted sources.
   • Update the Contact List plugin to 3.0.19 and update other plugins, themes, and WP core.
4. Recover
   • Rotate passwords for admin accounts, database credentials, and API keys.
   • Reissue any leaked tokens or secrets.
   • Reopen the site only after confirming a clean state and patching.
5. Post-incident
   • Perform a root cause analysis to determine how the Contributor account was created or abused.
   • Harden account provisioning and review role assignments.
   • Enable monitoring and regular integrity scans.

Hardening and longer-term practices

• Enforce least privilege: only grant Contributor or higher to users that truly need it.
• Remove unfiltered_html from non-admin users.
• Keep plugins, themes, and core up to date and use auto-updates for critical security patches when practical.
• Use multi-factor authentication for editors and admins.
• Test plugin changes in staging before deploying to production.
• Implement CSP and other security headers (X-Frame-Options, Referrer-Policy).
• Maintain verified backups and a tested recovery process.
• Schedule automated malware and integrity scans.

Developer guidance: safe server-side sanitization

Prefer storing validated tokens or URLs instead of raw HTML. Use server-side whitelisting where needed. Examples:

 array( 'href' => true, 'title' => true, 'rel' => true ),
        'br' => array(),
        'em' => array(),
        'strong' => array(),
    );
    return wp_kses( $input, $allowed );
}

// Option B: if the plugin expects a URL, validate it and restrict hosts
function validate_map_url( $url ) {
    $url = trim( $url );
    if ( empty( $url ) ) {
        return '';
    }
    if ( wp_http_validate_url( $url ) === false ) {
        return '';
    }
    $allowed_hosts = array( 'maps.example.com', 'www.maps.example.com' );
    $host = parse_url( $url, PHP_URL_HOST );
    if ( ! in_array( $host, $allowed_hosts, true ) ) {
        return '';
    }
    return esc_url_raw( $url );
}
?>

Monitoring and alerts to add immediately

• Alert on changes to plugin option values that include HTML tags or javascript: strings.
• Notify on sudden configuration changes to Contact List plugin entries.
• Monitor failed login spikes and unusual contributor activity.
• Schedule periodic DB scans for suspicious patterns and quarantine matches after validation.

Why WAF + plugin updates matter

Plugin updates address the root cause in code. A properly configured firewall or request-filtering control provides a temporary safety net when updates cannot be applied immediately. Use WAF rules that are focused and scoped to the plugin parameter and admin endpoint to reduce false positives.

Final checklist — what to do right now

1. Update Contact List to 3.0.19 (or later) — top priority.
2. If you cannot update immediately:
   • Apply a targeted rule to block or sanitize the _cl_map_iframe parameter.
   • Restrict Contributor capabilities and review accounts.
3. Search the database for , , javascript:, and _cl_map_iframe entries and neutralize suspicious content.
4. Rotate passwords for accounts active around suspicious activity and enable MFA for privileged users.
5. Run a full site malware scan and review file integrity.
6. Preserve evidence and follow an incident response process if compromise is suspected.
7. Implement long-term hardening: least privilege, tested updates, CSP, and monitoring.