CVE-2025-11197
BaseFortify
Publication date: 2025-10-11
Last updated on: 2025-10-14
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordpress | simple_draft_list | 2.6.2 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-11197 is a Stored Cross-Site Scripting (XSS) vulnerability in the Draft List WordPress plugin (up to version 2.6.1). It occurs because the plugin does not properly sanitize and escape user-supplied input in its 'drafts' shortcode attributes. This allows authenticated users with contributor-level access or higher to inject malicious scripts into pages. These scripts execute whenever any user views the affected page, potentially compromising user data or site integrity. [1, 2]
How can this vulnerability impact me? :
This vulnerability can allow an attacker with contributor-level access to inject arbitrary JavaScript into pages via the Draft List plugin. When other users visit these pages, the malicious scripts execute in their browsers, potentially leading to session hijacking, data theft, defacement, or other malicious actions. It compromises the security and trustworthiness of the affected WordPress site. [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if the WordPress site is running the Draft List plugin version 2.6.1 or earlier, as these versions contain the vulnerable code. You can verify the plugin version via the WordPress admin dashboard or by inspecting the plugin files. Additionally, you can search for the presence of the vulnerable shortcode 'drafts' in posts or pages that might contain injected scripts. There are no specific network commands provided in the resources, but scanning for the plugin version and inspecting pages using the 'drafts' shortcode for suspicious scripts can help detect exploitation attempts. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update the Draft List WordPress plugin to version 2.6.2 or later, where the vulnerability has been fixed by proper sanitization and escaping of user inputs and outputs. If updating is not immediately possible, restrict contributor-level access and above to trusted users only, as the vulnerability requires authenticated contributor-level access. Additionally, review and sanitize any content using the 'drafts' shortcode to remove potentially injected scripts. [1, 2]