blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-49466

MEDIUM 6.5 CVSS 3.1
Published
August 12, 2026
Last modified
September 8, 2026
NVD status
Deferred
Reported by
security-advisories@github.com
Weakness
CWE-79
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Description

Draft List is a WordPress plugin to manage and promote unpublished content. Versions 2.6.3 and below are vulnerable to stored Cross-Site Scripting (XSS) in the `[drafts]` shortcode and Draft List widget when the documented custom `template` option places the `{{draft}}` placeholder inside an HTML attribute. The vulnerable code inserts the raw draft `post_title` into `{{draft}}` when the current viewer cannot edit posts. Because the template is sanitized before `{{draft}}` replacement, a Contributor can store a quote-only title payload that breaks out of an attribute in a site-configured Draft List template and executes JavaScript for visitors who load the public page. Version 2.6.4 fixes the issue.

Affected WordPress components

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • dartiss draft-list — Version < 2.6.4

References

  • github.com https://github.com/dartiss/draft-list/compare/2.6.3...2.6.4
  • github.com https://github.com/dartiss/draft-list/releases/tag/2.6.4
  • github.com https://github.com/dartiss/draft-list/security/advisories/GHSA-xxx9-hfqp-f83f
  • nvd.nist.gov Official NVD record