CVE-2025-10181
BaseFortify
Publication date: 2025-09-20
Last updated on: 2025-09-22
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordpress | wordpress | * |
| dartiss | simple-draft-list | 2.6.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-10181 is a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress Draft List plugin (also known as simple-draft-list) up to version 2.6. It occurs because the plugin does not properly sanitize or escape user-supplied attributes in its 'drafts' shortcode. This allows authenticated users with contributor-level access or higher to inject malicious web scripts into pages. These scripts execute whenever any user accesses the injected page, potentially compromising site security. The vulnerability was fixed in version 2.6.1 by implementing strict HTML input sanitization using a defined allowed HTML tag list and WordPress's wp_kses() function to filter and safely decode template content, preventing script injection. [1, 2, 3]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing authenticated users with contributor-level or higher permissions to inject malicious scripts into your WordPress site via the Draft List plugin's shortcode. These scripts can execute in the browsers of users who view the affected pages, leading to cross-site scripting (XSS) attacks. Potential impacts include theft of user credentials, session hijacking, unauthorized actions performed on behalf of users, defacement, or distribution of malware. Since the vulnerability allows script injection that executes in other users' browsers, it poses a significant security risk to site integrity and user data confidentiality. [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of CVE-2025-10181 involves identifying usage of the vulnerable Draft List WordPress plugin versions up to 2.6, especially if the shortcode [drafts] is used with user-supplied parameters. You can check the plugin version installed on your WordPress site and look for suspicious shortcode usage or unexpected script injections in pages displaying draft lists. Since the vulnerability involves stored cross-site scripting via shortcode parameters, monitoring HTTP requests and responses for injected scripts in pages using the plugin can help detect exploitation attempts. Specific commands to detect the plugin version include using WP-CLI: `wp plugin list` to identify the version of simple-draft-list installed. Additionally, scanning your WordPress site's content for the presence of the `[drafts]` shortcode and inspecting its parameters for suspicious input can be done via database queries or site content searches. Network-level detection might involve monitoring for unusual script payloads in HTTP traffic targeting pages that use the Draft List plugin. [2, 3]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update the Draft List WordPress plugin to version 2.6.1 or later, where the vulnerability has been fixed by properly sanitizing and escaping shortcode inputs to prevent script injection. If updating immediately is not possible, restrict contributor-level and above users from using the shortcode or limit their ability to add or edit draft lists until the patch is applied. Additionally, review and sanitize any existing shortcode parameters in your content to remove potentially malicious scripts. Ensure your WordPress installation and PHP version meet the plugin's requirements (PHP 7.4+ and WordPress 4.6+) to support the fixed version. Monitoring and applying security best practices for user permissions can also reduce risk. [1, 2]