CVE-2026-49466

Received Received - Intake

Stored XSS in Draft List WordPress Plugin

Publication date: 2026-08-12

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description

Draft List is a WordPress plugin to manage and promote unpublished content. Versions 2.6.3 and below are vulnerable to stored Cross-Site Scripting (XSS) in the `[drafts]` shortcode and Draft List widget when the documented custom `template` option places the `{{draft}}` placeholder inside an HTML attribute. The vulnerable code inserts the raw draft `post_title` into `{{draft}}` when the current viewer cannot edit posts. Because the template is sanitized before `{{draft}}` replacement, a Contributor can store a quote-only title payload that breaks out of an attribute in a site-configured Draft List template and executes JavaScript for visitors who load the public page. Version 2.6.4 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-13

Generated

2026-09-02

AI Q&A

2026-08-13

EPSS Evaluated

2026-08-31

NVD

CVE-2026-49466

EUVD

EUVD-2026-57514

Affected Vendors & Products

Vendor	Product	Version / Range
dartiss	draft_list	to 2.6.4 (exc)
dartiss	draft_list	2.6.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a stored Cross-Site Scripting (XSS) vulnerability in the Draft List WordPress plugin versions 2.6.3 and below. It occurs when a Contributor sets a malicious draft title containing a quote-only payload like x" onerror="alert(1). The payload is stored and later inserted into a custom Draft List template where the {{draft}} placeholder is placed inside an HTML attribute. When rendered for visitors without edit permissions, the malicious title breaks out of the attribute and executes JavaScript.

The vulnerability requires a custom Draft List template configured to place {{draft}} inside an HTML attribute. The issue stems from insufficient sanitization of the draft title before inserting it into the template.

Detection Guidance

Check for Draft List plugin versions 2.6.3 or below. Inspect WordPress sites for custom Draft List templates using the [drafts] shortcode or widget with {{draft}} inside HTML attributes. Look for malicious draft titles containing JavaScript payloads like x" onerror="alert(1).

Commands: grep -r "draft-list" /path/to/wordpress/plugins/ | grep -E "Version: (2\.6\.[0-3]|2\.6\.3)". Check template files for {{draft}} in attributes like href="{{draft}}" or title="{{draft}}".

Impact Analysis

The injected script can read page content, modify the page, or disrupt the user's session. This could lead to theft of sensitive data, unauthorized actions on behalf of users, or defacement of the website. Visitors viewing the public page are affected even if they have no edit permissions.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection and confidentiality. It may result in data breaches, unauthorized modifications, or loss of integrity of sensitive information, potentially leading to legal and regulatory penalties.

Mitigation Strategies

Update the Draft List plugin to version 2.6.4 or later immediately. Remove any custom Draft List templates that place {{draft}} inside HTML attributes. Review draft titles for suspicious payloads and remove any malicious entries.

Hi! I’m here to help you understand CVE-2026-49466. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70