EUVD-2026-57514
GHSA-7f2v-x3jw-5w6g
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
AC:H reflects the non-default operator-configured template condition required for exploitation; A:N applies as XSS carries no direct availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Draft List is a WordPress plugin to manage and promote unpublished content. Versions 2.6.3 and below are vulnerable to stored Cross-Site Scripting (XSS) in the [drafts] shortcode and Draft List widget when the documented custom template option places the {{draft}} placeholder inside an HTML attribute. The vulnerable code inserts the raw draft post_title into {{draft}} when the current viewer cannot edit posts. Because the template is sanitized before {{draft}} replacement, a Contributor can store a quote-only title payload that breaks out of an attribute in a site-configured Draft List template and executes JavaScript for visitors who load the public page. Version 2.6.4 fixes the issue.
AnalysisAI
Stored XSS in the Draft List WordPress plugin (versions ≤2.6.3) allows a Contributor-level authenticated user to inject persistent JavaScript into public-facing pages by exploiting a sanitization ordering flaw in the [drafts] shortcode and widget template engine. The plugin sanitizes the template string before substituting the {{draft}} placeholder with the raw post_title, meaning a crafted title containing a double-quote can break out of an HTML attribute context and execute arbitrary JavaScript in the browsers of visitors who load the affected page. Version 2.6.4 resolves the issue; no public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
The Draft List plugin (CPE: cpe:2.3:a:dartiss:draft-list) by dartiss provides a WordPress shortcode [drafts] and a sidebar widget that render lists of unpublished content using a configurable template string supporting a {{draft}} placeholder. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): the plugin sanitizes the template for XSS before performing the {{draft}} → post_title string substitution, not after. This ordering means any XSS-relevant characters (notably double-quotes) in a post title bypass sanitization entirely. When a site administrator configures a template that places {{draft}} inside an HTML attribute - for example as a href or title value - a Contributor who lacks edit_posts capability can craft a draft title that closes the attribute, injects an event handler, and achieves stored XSS execution against site visitors.
RemediationAI
Update the Draft List plugin to version 2.6.4, available at https://github.com/dartiss/draft-list/releases/tag/2.6.4; this release patches the sanitization ordering flaw confirmed by the vendor advisory at https://github.com/dartiss/draft-list/security/advisories/GHSA-xxx9-hfqp-f83f. If immediate upgrade is not feasible, audit all active [drafts] shortcode configurations and Draft List widget instances to verify that no custom template places the {{draft}} placeholder inside an HTML attribute (e.g., as href, title, or data-* values); moving the placeholder to text node context removes the injection vector without disabling the plugin. Additionally, reviewing and restricting who holds Contributor (or higher) roles on the site reduces the attacker pool in the interim. Note that restricting Contributor roles has broader access implications and should be evaluated against site editorial workflow needs.
More in Draft List
View allStored Cross-Site Scripting in the Draft List WordPress plugin (versions up to and including 2.6.3) allows authenticated
The Simple Draft List WordPress plugin for Dartiss contains a Stored Cross-Site Scripting vulnerability in versions up t
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today