Read the docs
TI-2026-36621 Aliases CVE-2026-49466GHSA-7f2v-x3jw-5w6g

Draft List - Contributor Stored Cross-Site Scripting via Draft Title in Custom Drafts Template Attributes

Priority MEDIUM 62CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Draft List is a WordPress plugin to manage and promote unpublished content. Versions 2.6.3 and below are vulnerable to stored Cross-Site Scripting (XSS) in the `[drafts]` shortcode and Draft List widget when the documented custom `template` option places the `{{draft}}` placeholder inside an HTML attribute. The vulnerable code inserts the raw draft `post_title` into `{{draft}}` when the current viewer cannot edit posts. Because the template is sanitized before `{{draft}}` replacement, a Contributor can store a quote-only title payload that breaks out of an attribute in a site-configured Draft List template and executes JavaScript for visitors who load the public page. Version 2.6.4 fixes the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00287 21st percentileScored 2026-11-07
Fix Fixed draft-list (dartiss): 2.6.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
dartissdraft-listbefore 2.6.42.6.4Patch availableCNA
  • draft-list Vendordartiss Affected before 2.6.4 Fixed in 2.6.4 Patch available CNA

Remediation

  • Fix · CNA draft-list (dartiss) Fixed in 2.6.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-49466
  2. 2026-10-03 Alias added: GHSA-7f2v-x3jw-5w6g

References

Other 3

  • TI-2026-35533 Code Embed - Contributor Stored Cross-Site Scripting via Remote URL Embed CVSS 3.1MEDIUM 6.5
  • TI-2026-35534 ShareOpenly has Cross-Site Scripting (XSS) via Missing esc_url() on Shared URL in Content Output CVSS 4.0MEDIUM 5.3
  • TI-2026-08001 Draft List <= 2.6.3 - Authenticated (Author+) Stored Cross-Site Scripting via Draft Post Title CVSS 3.1MEDIUM 6.4
  • TI-2026-05973 Social Post Embed <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Threads Embed CVSS 3.1MEDIUM 6.4
  • TI-2026-03469 Draft List <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'display_name' Parameter CVSS 3.1MEDIUM 6.4
  • TI-2026-02138 Code Embed <= 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Fields CVSS 3.1MEDIUM 6.4
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences