What is the CVSS score of CVE-2026-9104?

CVE-2026-9104 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Draft List CVE-2026-9104

EUVD-2026-31405 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-22 Wordfence

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 22, 2026 - 05:19 vuln.today

DescriptionCVE.org

The Draft List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Draft Post Title in all versions up to, and including, 2.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The unescaped injection path is triggered specifically when the viewing user lacks edit capabilities, meaning payloads embedded in draft post titles via attribute-breakout techniques execute for unauthenticated users and subscribers.

AnalysisAI

Stored Cross-Site Scripting in the Draft List WordPress plugin (versions up to and including 2.6.3) allows authenticated attackers with author-level access to inject arbitrary web scripts into draft post titles using attribute-breakout techniques. The critical aggravating factor is the changed scope (S:C in CVSS): the unescaped rendering path is specifically triggered for users who lack edit capabilities, meaning the payload executes against unauthenticated visitors and subscribers - not just privileged users. No public exploit has been identified at time of analysis, but Wordfence disclosure and the low privilege bar (author-level sufficient) make this a meaningful cross-user threat in any multi-author WordPress environment.

Technical ContextAI

The vulnerability resides in the Draft List plugin for WordPress, developed by dartiss (CPE: cpe:2.3:a:dartiss:draft_list:*:*:*:*:*:*:*:*), specifically within inc/create-lists.php at lines 66, 305, and 396 in the 2.6.3 tagged release. CWE-79 (Improper Neutralization of Input During Web Page Generation) describes the root cause: draft post titles are persisted to the WordPress database and later rendered without output escaping when displayed through the plugin's list-rendering functions. The attribute-breakout technique referenced in the description indicates the title is output inside an HTML attribute context - without escaping double quotes, angle brackets, or event handler characters - allowing an attacker to break out of the attribute and inject executable JavaScript. WordPress Plugin Trac references for version 2.6.4 show corrected output handling at lines 389, 391, and 394 of the same file, indicating the fix involved adding targeted escaping at specific render call sites. The dual rendering code paths (lines 305 vs. 396 in 2.6.3) suggest the plugin conditionally renders output depending on user capability checks, and only the non-editor path lacked escaping.

RemediationAI

Upgrade the Draft List plugin to version 2.6.4 or later, which introduces targeted output escaping fixes in inc/create-lists.php at the rendering call sites identified in the Trac diff. The upstream fix is visible at https://plugins.trac.wordpress.org/browser/simple-draft-list/tags/2.6.4/inc/create-lists.php - a formal released patched version is probable based on these references but has not been independently confirmed via a dedicated vendor security advisory. If immediate upgrade is not feasible, the most effective compensating control is to deactivate the Draft List plugin entirely, which eliminates the attack surface with no side effects beyond loss of draft listing functionality. Alternatively, audit and restrict author-level WordPress role assignments to fully trusted accounts only, reducing the pool of potential injectors; note this does not eliminate the vulnerability, only limits who can exploit it. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/07361278-7abb-4d22-a8df-218d3f982483 should be monitored for updated patch confirmation.