{"id":"CVE-2026-49466","title":"Draft List is a WordPress plugin to manage and promote unpublished content","summary":"Draft List is a WordPress plugin to manage and promote unpublished content. Versions 2.6.3 and below are vulnerable to stored Cross-Site Scripting (XSS) in the `[drafts]` shortcode and Draft List widget when the documented custom `templa…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cwe":["CWE-79"],"published":"2026-08-12","updated":"2026-09-08","sourceUpdated":"2026-09-08T20:56:50.520","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-49466","references":[{"url":"https://github.com/dartiss/draft-list/compare/2.6.3...2.6.4","label":"security-advisories@github.com"},{"url":"https://github.com/dartiss/draft-list/releases/tag/2.6.4","label":"security-advisories@github.com"},{"url":"https://github.com/dartiss/draft-list/security/advisories/GHSA-xxx9-hfqp-f83f","label":"security-advisories@github.com"},{"url":"https://github.com/dartiss/draft-list/security/advisories/GHSA-xxx9-hfqp-f83f","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd"],"epss":0.00287,"epssPercentile":0.18916,"ingestedAt":"2026-09-08T21:11:12.276Z","slug":"CVE-2026-49466","body":"## Overview\n\nDraft List is a WordPress plugin to manage and promote unpublished content. Versions 2.6.3 and below are vulnerable to stored Cross-Site Scripting (XSS) in the `[drafts]` shortcode and Draft List widget when the documented custom `template` option places the `{{draft}}` placeholder inside an HTML attribute. The vulnerable code inserts the raw draft `post_title` into `{{draft}}` when the current viewer cannot edit posts. Because the template is sanitized before `{{draft}}` replacement, a Contributor can store a quote-only title payload that breaks out of an attribute in a site-configured Draft List template and executes JavaScript for visitors who load the public page. Version 2.6.4 fixes the issue.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}