Vulnerability · Published Aug 12, 2026 · Assigned by GitHub_M

CVE-2026-49466Draft List - Contributor Stored Cross-Site Scripting via Draft Title in Custom Drafts Template Attributes

Medium 6.5

In plain English

A medium-severity cross-site scripting in draft-list from dartiss. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 78.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Draft List is a WordPress plugin to manage and promote unpublished content. Versions 2.6.3 and below are vulnerable to stored Cross-Site Scripting (XSS) in the `[drafts]` shortcode and Draft List widget when the documented custom `template` option places the `{{draft}}` placeholder inside an HTML attribute. The vulnerable code inserts the raw draft `post_title` into `{{draft}}` when the current viewer cannot edit posts. Because the template is sanitized before `{{draft}}` replacement, a Contributor can store a quote-only title payload that breaks out of an attribute in a site-configured Draft List template and executes JavaScript for visitors who load the public page. Version 2.6.4 fixes the issue.

Affected products (as reported)

Vendor	Product	Versions
dartiss	draft-list	< 2.6.4

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

References

https://github.com/dartiss/draft-list/security/advisories/GHSA-xxx9-hfqp-f83f x_refsource_CONFIRM
https://github.com/dartiss/draft-list/compare/2.6.3...2.6.4 x_refsource_MISC
https://github.com/dartiss/draft-list/releases/tag/2.6.4 x_refsource_MISC