Draft List CVE-2025-11197

Requires the Draft List plugin (≤2.6.1) installed and active, and an attacker holding at least a contributor-level authenticated account on the site. The attacker must place the plugin's 'drafts' shortcode with a crafted attribute into content that is subsequently rendered to other users; the payload fires when any user (including an admin) views that page. Limiting factors: exploitation is gated by the contributor authentication requirement (PR:L), depends on the site actually permitting/using the 'drafts' shortcode in author-editable content, and requires a victim to view the injected page. No special non-default server configuration is otherwise needed.

This is a moderate-risk, authenticated Stored XSS (CWE-79) with a self-consistent CVSS 3.1 profile of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N): network-reachable, low complexity, but requiring contributor-level privileges (PR:L) and yielding only low confidentiality/integrity impact with a scope change reflecting script execution in other users' browser contexts. All exploitation signals point toward low real-world urgency: EPSS is 0.23% (13th percentile), there is no CISA KEV listing, and no public exploit code was identified in the provided intelligence. The signals are consistent rather than conflicting - a low EPSS aligns with the absence of KEV/POC and with the privilege barrier. The practical limiter is PR:L: an attacker must already hold a contributor (or higher) account, so this is not a mass-exploitable unauthenticated flaw but rather a privilege-escalation/persistence primitive useful on multi-author sites or after account compromise. No SSVC decision data was provided in the input. Net: a legitimate but non-urgent 'patch in normal cycle' issue rather than an emergency, driven down by the authentication requirement and the niche, small-footprint plugin.

An attacker with a contributor account on a WordPress site running Draft List ≤2.6.1 embeds the 'drafts' shortcode with a malicious attribute containing JavaScript, then gets the content published or previewed. When an administrator or visitor loads the page, the unsanitized shortcode attribute renders and the script executes in their browser, enabling session/cookie theft or admin actions. No public exploit code was identified at time of analysis, though the fixing diff publicly illustrates the vulnerable sink.