Draft List
Monthly
Stored XSS in the Draft List WordPress plugin (versions ≤2.6.3) allows a Contributor-level authenticated user to inject persistent JavaScript into public-facing pages by exploiting a sanitization ordering flaw in the [drafts] shortcode and widget template engine. The plugin sanitizes the template string before substituting the {{draft}} placeholder with the raw post_title, meaning a crafted title containing a double-quote can break out of an HTML attribute context and execute arbitrary JavaScript in the browsers of visitors who load the affected page. Version 2.6.4 resolves the issue; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in the Draft List WordPress plugin (versions up to and including 2.6.3) allows authenticated attackers with author-level access to inject arbitrary web scripts into draft post titles using attribute-breakout techniques. The critical aggravating factor is the changed scope (S:C in CVSS): the unescaped rendering path is specifically triggered for users who lack edit capabilities, meaning the payload executes against unauthenticated visitors and subscribers - not just privileged users. No public exploit has been identified at time of analysis, but Wordfence disclosure and the low privilege bar (author-level sufficient) make this a meaningful cross-user threat in any multi-author WordPress environment.
The Simple Draft List WordPress plugin for Dartiss contains a Stored Cross-Site Scripting vulnerability in versions up to 2.6.2, caused by insufficient input sanitization and output escaping of the 'display_name' post meta field. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript via the {{author+link}} template tag when no author URL is present, which will execute whenever users visit pages containing the [drafts] shortcode. The vulnerability has a CVSS score of 6.4 with a network attack vector and low attack complexity, requiring only low-level privileges.
Stored XSS in the Draft List WordPress plugin (versions ≤2.6.3) allows a Contributor-level authenticated user to inject persistent JavaScript into public-facing pages by exploiting a sanitization ordering flaw in the [drafts] shortcode and widget template engine. The plugin sanitizes the template string before substituting the {{draft}} placeholder with the raw post_title, meaning a crafted title containing a double-quote can break out of an HTML attribute context and execute arbitrary JavaScript in the browsers of visitors who load the affected page. Version 2.6.4 resolves the issue; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in the Draft List WordPress plugin (versions up to and including 2.6.3) allows authenticated attackers with author-level access to inject arbitrary web scripts into draft post titles using attribute-breakout techniques. The critical aggravating factor is the changed scope (S:C in CVSS): the unescaped rendering path is specifically triggered for users who lack edit capabilities, meaning the payload executes against unauthenticated visitors and subscribers - not just privileged users. No public exploit has been identified at time of analysis, but Wordfence disclosure and the low privilege bar (author-level sufficient) make this a meaningful cross-user threat in any multi-author WordPress environment.
The Simple Draft List WordPress plugin for Dartiss contains a Stored Cross-Site Scripting vulnerability in versions up to 2.6.2, caused by insufficient input sanitization and output escaping of the 'display_name' post meta field. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript via the {{author+link}} template tag when no author URL is present, which will execute whenever users visit pages containing the [drafts] shortcode. The vulnerability has a CVSS score of 6.4 with a network attack vector and low attack complexity, requiring only low-level privileges.