CVE-2025-11197
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The Draft List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'drafts' shortcode in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Risk Assessment
An authenticated attacker with contributor-level permissions can inject persistent malicious scripts that execute for other users, potentially leading to session hijacking or malware distribution.
Recommendation
Update the Draft List plugin to a version later than 2.6.1. Limit the number of users with contributor-level permissions and regularly review page content.
Other vulnerabilities in Draft List
See all- CVE-2026-66603Medium
Cross-site Scripting (XSS) vulnerability in the Draft List plugin (simple-draft-list) allows stored XSS. Versions up to 2.6.4 are affected.
- CVE-2026-49466Medium
Draft List is a WordPress plugin to manage and promote unpublished content. Versions 2.6.3 and below are vulnerable to stored Cross-Site Scripting (XSS) in the `[drafts]` shortcode and Draft List widget when the documented custom `template` option places the `{{draft}}` placeholder inside an HTML attribute. The vulnerable code inserts the raw draft `post_title` into `{{draft}}` when the current viewer cannot edit posts. Because the template is sanitized before `{{draft}}` replacement, a Contributor can store a quote-only title payload that breaks out of an attribute in a site-configured Draft List template and executes JavaScript for visitors who load the public page. Version 2.6.4 fixes the issue.
- CVE-2026-9104Medium
The Draft List plugin for WordPress up to version 2.6.3 has a Stored XSS vulnerability via draft post titles. Authenticated attackers with author-level access can inject scripts that execute for users without edit capabilities.
Original NVD description (English source)
The Draft List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'drafts' shortcode in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS