Draft List EUVD-2026-31405

Exploitation for injection requires an authenticated WordPress account at author level or higher - the CVSS vector PR:L confirms low-privilege authenticated access is the minimum bar. The payload fires specifically against users who lack post-editing capabilities: unauthenticated visitors, subscribers, and contributor-level users. This means the attacker and the victim are different user classes - the attacker writes the payload, but only lower-privileged or unauthenticated users trigger it. Sites where author-level access is restricted exclusively to fully trusted internal users are at reduced but not eliminated risk, since insider threat or account compromise at author level would still be sufficient. Sites with open or loosely vetted author registration are at highest risk. No special plugin configuration or non-default setting is required - any deployment of Draft List 2.6.3 or earlier that displays draft post titles to non-editor users is vulnerable by default.

The CVSS 6.4 Medium score (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) accurately reflects a stored XSS with low attack complexity and low privilege requirement, but the Changed Scope (S:C) elevates real-world risk considerably: impact crosses security boundaries from the authenticated attacker's session into the sessions of unauthenticated users and subscribers. The UI:N designation for stored XSS is consistent - no additional user interaction beyond ordinary page browsing is required for payload execution once injected. No CISA KEV listing and no publicly identified exploit code suggest this is not currently subject to mass exploitation; however, Wordfence's public disclosure and the availability of source code diffs in Plugin Trac lower the barrier to exploit development. The EPSS score was not provided in the supplied data and cannot be assessed quantitatively. Real-world priority is highest for WordPress sites that allow untrusted or loosely vetted users to hold author-level roles, and for sites with high public traffic where the victim surface is large. Sites where author access is tightly controlled face substantially reduced risk.

An attacker holding an author-level WordPress account on a site running Draft List 2.6.3 or earlier creates or edits a draft post, setting its title to a payload that breaks out of an HTML attribute context - for example, closing a quote, injecting an onerror or onmouseover event handler, or appending a script tag. When any user without post-editing capabilities (an unauthenticated visitor, a subscriber, or a contributor who cannot edit others' posts) loads a page that renders the plugin's draft list, the browser executes the injected payload in that user's session context. The attacker could use this to exfiltrate session cookies, perform credential-harvesting redirects, or deface the rendered page for victim users. No public exploit code has been identified at time of analysis.