CVE-2026-49466
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
Draft List is a WordPress plugin to manage and promote unpublished content. Versions 2.6.3 and below are vulnerable to stored Cross-Site Scripting (XSS) in the `[drafts]` shortcode and Draft List widget when the documented custom `template` option places the `{{draft}}` placeholder inside an HTML attribute. The vulnerable code inserts the raw draft `post_title` into `{{draft}}` when the current viewer cannot edit posts. Because the template is sanitized before `{{draft}}` replacement, a Contributor can store a quote-only title payload that breaks out of an attribute in a site-configured Draft List template and executes JavaScript for visitors who load the public page. Version 2.6.4 fixes the issue.
Risk Assessment
The risk includes execution of malicious scripts in visitors' browsers, potentially leading to session theft, defacement, or other attacks on users.
Recommendation
Upgrade the Draft List plugin to version 2.6.4 or later and restrict contributor permissions to create titles with special characters.
Other vulnerabilities in Draft List
See all- CVE-2026-66603Medium
Cross-site Scripting (XSS) vulnerability in the Draft List plugin (simple-draft-list) allows stored XSS. Versions up to 2.6.4 are affected.
- CVE-2026-9104Medium
The Draft List plugin for WordPress up to version 2.6.3 has a Stored XSS vulnerability via draft post titles. Authenticated attackers with author-level access can inject scripts that execute for users without edit capabilities.
- CVE-2025-11197Medium
The Draft List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'drafts' shortcode in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Original NVD description (English source)
Draft List is a WordPress plugin to manage and promote unpublished content. Versions 2.6.3 and below are vulnerable to stored Cross-Site Scripting (XSS) in the `[drafts]` shortcode and Draft List widget when the documented custom `template` option places the `{{draft}}` placeholder inside an HTML attribute. The vulnerable code inserts the raw draft `post_title` into `{{draft}}` when the current viewer cannot edit posts. Because the template is sanitized before `{{draft}}` replacement, a Contributor can store a quote-only title payload that breaks out of an attribute in a site-configured Draft List template and executes JavaScript for visitors who load the public page. Version 2.6.4 fixes the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS