Executive brief
The Draft List plugin for WordPress, which helps site administrators manage and display draft posts, contains a security flaw. An attacker with author-level access can insert malicious scripts into draft post titles. These scripts then run in the browsers of other site visitors, potentially leading to unauthorized actions or data theft.
Technical details
The Draft List plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on draft post titles. Authenticated attackers with author-level permissions or higher can inject malicious web scripts using attribute-breakout techniques. The vulnerability is specifically triggered when the viewing user lacks edit capabilities, such as unauthenticated visitors or subscribers. This allows the stored payload to execute in the context of the victim's browser session. The issue is present in all versions up to 2.6.3 and appears to be addressed in version 2.6.4.
Affected products
- WordPress Draft List Up to and including 2.6.3
Timeline
- 2026-05-22: disclosed
- 2026-05-22: advisory
References
- https://plugins.trac.wordpress.org/browser/simple-draft-list/tags/2.6.3/inc/create-lists.php
- https://plugins.trac.wordpress.org/browser/simple-draft-list/tags/2.6.3/inc/create-lists.php
- https://plugins.trac.wordpress.org/browser/simple-draft-list/tags/2.6.3/inc/create-lists.php
- https://plugins.trac.wordpress.org/browser/simple-draft-list/tags/2.6.4/inc/create-lists.php
- https://plugins.trac.wordpress.org/browser/simple-draft-list/tags/2.6.4/inc/create-lists.php
- https://plugins.trac.wordpress.org/browser/simple-draft-list/tags/2.6.4/inc/create-lists.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/07361278-7abb-4d22-a8df-218d3f982483?source=cve