Dartiss
Monthly
Stored XSS in the Draft List WordPress plugin (versions ≤2.6.3) allows a Contributor-level authenticated user to inject persistent JavaScript into public-facing pages by exploiting a sanitization ordering flaw in the [drafts] shortcode and widget template engine. The plugin sanitizes the template string before substituting the {{draft}} placeholder with the raw post_title, meaning a crafted title containing a double-quote can break out of an HTML attribute context and execute arbitrary JavaScript in the browsers of visitors who load the affected page. Version 2.6.4 resolves the issue; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stored XSS in the Code Embed WordPress plugin (versions prior to 2.6.1) permits a Contributor-role attacker to plant a URL embed token referencing an attacker-controlled server; when an Administrator or Editor previews or reviews the pending post, the plugin fetches the remote URL and injects the unfiltered response body-including arbitrary JavaScript-directly into the rendered page. The root cause is a dual omission in add-embeds.php: no output sanitization on fetched remote content and no unfiltered_html capability check before URL-embed expansion, a pattern confirmed by the commit diff from the fix release. No public exploit has been identified at time of analysis; vendor-released patch 2.6.1 is confirmed by a GitHub release tag, a commit, and the plugin changelog.
Cross-site scripting in the ShareOpenly WordPress plugin (versions prior to 1.2.1) allows JavaScript injection into every visitor's browser via an unescaped `$url` variable concatenated directly into an HTML href attribute on all singular posts and pages where the sharing link is rendered. The root cause is the absence of WordPress's mandatory `esc_url()` function on a URL constructed from `home_url( add_query_arg( array(), $wp->request ) )`, meaning any plugin, theme, or server configuration that taints that base URL via a `home_url` filter can introduce HTML-special characters or a `javascript:` URI scheme into the rendered page without sanitization. No public exploit has been identified at time of analysis; vendor-released patch version 1.2.1 is available and confirmed.
Stored Cross-Site Scripting in the Draft List WordPress plugin (versions up to and including 2.6.3) allows authenticated attackers with author-level access to inject arbitrary web scripts into draft post titles using attribute-breakout techniques. The critical aggravating factor is the changed scope (S:C in CVSS): the unescaped rendering path is specifically triggered for users who lack edit capabilities, meaning the payload executes against unauthenticated visitors and subscribers - not just privileged users. No public exploit has been identified at time of analysis, but Wordfence disclosure and the low privilege bar (author-level sufficient) make this a meaningful cross-user threat in any multi-author WordPress environment.
Stored Cross-Site Scripting in Social Post Embed plugin for WordPress up to version 2.0.1 allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript into page content via the Threads embed handler due to insufficient input sanitization and output escaping. Injected scripts execute when any user views the affected page, enabling session hijacking, credential theft, or malware distribution from trusted WordPress sites. No public exploit code or active exploitation has been identified at the time of analysis.
The Simple Draft List WordPress plugin for Dartiss contains a Stored Cross-Site Scripting vulnerability in versions up to 2.6.2, caused by insufficient input sanitization and output escaping of the 'display_name' post meta field. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript via the {{author+link}} template tag when no author URL is present, which will execute whenever users visit pages containing the [drafts] shortcode. The vulnerability has a CVSS score of 6.4 with a network attack vector and low attack complexity, requiring only low-level privileges.
The Code Embed plugin for WordPress (versions up to 2.5.1) contains a stored cross-site scripting vulnerability that allows authenticated attackers with Contributor-level access or higher to inject arbitrary JavaScript into pages through custom field meta values. The vulnerability exists because the plugin's sanitization function only runs during post saves, while WordPress AJAX endpoints can add meta fields without triggering sanitization, and the plugin then outputs these unsanitized values directly without HTML escaping. An attacker can inject malicious scripts that execute whenever any user visits an affected page, potentially leading to session hijacking, credential theft, or malware distribution.
Stored XSS in the Draft List WordPress plugin (versions ≤2.6.3) allows a Contributor-level authenticated user to inject persistent JavaScript into public-facing pages by exploiting a sanitization ordering flaw in the [drafts] shortcode and widget template engine. The plugin sanitizes the template string before substituting the {{draft}} placeholder with the raw post_title, meaning a crafted title containing a double-quote can break out of an HTML attribute context and execute arbitrary JavaScript in the browsers of visitors who load the affected page. Version 2.6.4 resolves the issue; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stored XSS in the Code Embed WordPress plugin (versions prior to 2.6.1) permits a Contributor-role attacker to plant a URL embed token referencing an attacker-controlled server; when an Administrator or Editor previews or reviews the pending post, the plugin fetches the remote URL and injects the unfiltered response body-including arbitrary JavaScript-directly into the rendered page. The root cause is a dual omission in add-embeds.php: no output sanitization on fetched remote content and no unfiltered_html capability check before URL-embed expansion, a pattern confirmed by the commit diff from the fix release. No public exploit has been identified at time of analysis; vendor-released patch 2.6.1 is confirmed by a GitHub release tag, a commit, and the plugin changelog.
Cross-site scripting in the ShareOpenly WordPress plugin (versions prior to 1.2.1) allows JavaScript injection into every visitor's browser via an unescaped `$url` variable concatenated directly into an HTML href attribute on all singular posts and pages where the sharing link is rendered. The root cause is the absence of WordPress's mandatory `esc_url()` function on a URL constructed from `home_url( add_query_arg( array(), $wp->request ) )`, meaning any plugin, theme, or server configuration that taints that base URL via a `home_url` filter can introduce HTML-special characters or a `javascript:` URI scheme into the rendered page without sanitization. No public exploit has been identified at time of analysis; vendor-released patch version 1.2.1 is available and confirmed.
Stored Cross-Site Scripting in the Draft List WordPress plugin (versions up to and including 2.6.3) allows authenticated attackers with author-level access to inject arbitrary web scripts into draft post titles using attribute-breakout techniques. The critical aggravating factor is the changed scope (S:C in CVSS): the unescaped rendering path is specifically triggered for users who lack edit capabilities, meaning the payload executes against unauthenticated visitors and subscribers - not just privileged users. No public exploit has been identified at time of analysis, but Wordfence disclosure and the low privilege bar (author-level sufficient) make this a meaningful cross-user threat in any multi-author WordPress environment.
Stored Cross-Site Scripting in Social Post Embed plugin for WordPress up to version 2.0.1 allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript into page content via the Threads embed handler due to insufficient input sanitization and output escaping. Injected scripts execute when any user views the affected page, enabling session hijacking, credential theft, or malware distribution from trusted WordPress sites. No public exploit code or active exploitation has been identified at the time of analysis.
The Simple Draft List WordPress plugin for Dartiss contains a Stored Cross-Site Scripting vulnerability in versions up to 2.6.2, caused by insufficient input sanitization and output escaping of the 'display_name' post meta field. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript via the {{author+link}} template tag when no author URL is present, which will execute whenever users visit pages containing the [drafts] shortcode. The vulnerability has a CVSS score of 6.4 with a network attack vector and low attack complexity, requiring only low-level privileges.
The Code Embed plugin for WordPress (versions up to 2.5.1) contains a stored cross-site scripting vulnerability that allows authenticated attackers with Contributor-level access or higher to inject arbitrary JavaScript into pages through custom field meta values. The vulnerability exists because the plugin's sanitization function only runs during post saves, while WordPress AJAX endpoints can add meta fields without triggering sanitization, and the plugin then outputs these unsanitized values directly without HTML escaping. An attacker can inject malicious scripts that execute whenever any user visits an affected page, potentially leading to session hijacking, credential theft, or malware distribution.