CVE-2026-49466

MEDIUM 6.5

Draft List - Contributor Stored Cross-Site Scripting via Draft Title in Custom Drafts Template Attributes

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

Draft List is a WordPress plugin to manage and promote unpublished content. Versions 2.6.3 and below are vulnerable to stored Cross-Site Scripting (XSS) in the `[drafts]` shortcode and Draft List widget when the documented custom `template` option places the `{{draft}}` placeholder inside an HTML attribute. The vulnerable code inserts the raw draft `post_title` into `{{draft}}` when the current viewer cannot edit posts. Because the template is sanitized before `{{draft}}` replacement, a Contributor can store a quote-only title payload that breaks out of an attribute in a site-configured Draft List template and executes JavaScript for visitors who load the public page. Version 2.6.4 fixes the issue.

CWE	CWE-79
Vendor	dartiss
Product	draft-list
Published	Aug 12, 2026

Stay Ahead of the Next One

Get instant alerts for dartiss draft-list

Be the first to know when new medium vulnerabilities affecting dartiss draft-list are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Affected Versions

dartiss / draft-list

< 2.6.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/dartiss/draft-list/security/advisories/GHSA-xxx9-hfqp-f83f github.com: https://github.com/dartiss/draft-list/compare/2.6.3...2.6.4 github.com: https://github.com/dartiss/draft-list/releases/tag/2.6.4