CVE-2026-66603

Deferred Deferred - Pending Action

Stored XSS in Draft List WordPress Plugin

Publication date: 2026-08-18

Last updated on: 2026-08-19

Assigner: Patchstack

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Artiss Draft List simple-draft-list allows Stored XSS. This issue affects Draft List: from n/a through 2.6.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-19

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-66603

EUVD

EUVD-2026-62208

Affected Vendors & Products

Vendor	Product	Version / Range
david_artiss	draft_list	to 2.6.4 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a Stored Cross-Site Scripting (XSS) vulnerability in the David Artiss Draft List plugin. It occurs when user input is not properly neutralized during web page generation, allowing malicious scripts to be stored and later executed in the context of other users' browsers.

Detection Guidance

Detecting this Stored XSS vulnerability requires checking for vulnerable versions of the Draft List plugin. Inspect your WordPress installation for the simple-draft-list plugin version 2.6.4 or earlier. Look for unusual script injections in draft content or comments that may indicate exploitation.

Impact Analysis

An attacker could inject malicious scripts into the Draft List plugin. When other users view the affected pages, the scripts execute, potentially stealing session cookies, redirecting users to phishing sites, or performing actions on their behalf without consent.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations may face compliance breaches, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Immediately update the Draft List plugin to the latest version if available. If no update exists, consider disabling the plugin until a patch is released. Review stored drafts and comments for malicious scripts and remove any suspicious content.

Hi! I’m here to help you understand CVE-2026-66603. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70