Description

Draft List is a WordPress plugin to manage and promote unpublished content. Versions 2.6.3 and below are vulnerable to stored Cross-Site Scripting (XSS) in the `[drafts]` shortcode and Draft List widget when the documented custom `template` option places the `{{draft}}` placeholder inside an HTML attribute. The vulnerable code inserts the raw draft `post_title` into `{{draft}}` when the current viewer cannot edit posts. Because the template is sanitized before `{{draft}}` replacement, a Contributor can store a quote-only title payload that breaks out of an attribute in a site-configured Draft List template and executes JavaScript for visitors who load the public page. Version 2.6.4 fixes the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-12T20:17:44.713Z",
  "pubdate": "2026-08-12T20:17:44.713Z",
  "executiveSummary": "The Draft List WordPress plugin, in versions 2.6.3 and below, is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability within the `[drafts]` shortcode and the Draft List widget. This security flaw stems from improper handling of user-supplied post titles when the documented custom `template` option places the `{{draft}}` placeholder inside an HTML attribute. The vulnerability allows an authenticated attacker with Contributor-level privileges to store malicious JavaScript payloads by leveraging a quote-only title designed to break out of HTML attribute contexts. When unprivileged site visitors or users incapable of editing posts load a public-facing page containing the vulnerable shortcode or widget, the injected payload executes within the context of their browser session. The potential impact includes unauthorized execution of arbitrary script code, session hijacking, defacement, or redirection to malicious external resources. Exploitation requires the attacker to hold Contributor privileges to create the malicious unpublished content and relies on the existence of a site-configured Draft List template that improperly embeds the `{{draft}}` placeholder within HTML attributes. The vulnerability is fully resolved in version 2.6.4.",
  "technicalDetails": "The vulnerability resides in the `[drafts]` shortcode and the Draft List widget components of the Draft List plugin. The root cause of the flaw is contextual output misplacement and insufficient sanitization ordering during the rendering of unpublished draft posts for viewers lacking post editing capabilities. Specifically, when the current viewer is unauthorized to edit posts, the plugin retrieves the raw draft `post_title` and substitutes it directly into the `{{draft}}` placeholder without appropriate contextual output encoding for HTML attributes. Although the template itself undergoes sanitization prior to the `{{draft}}` replacement phase, this sequence creates a security gap where untrusted database-stored input is interpolated directly into an attribute context. An attacker possessing Contributor privileges can exploit this behavior by crafting an unpublished post with a specifically engineered quote-only title payload. This payload is engineered to prematurely close the surrounding HTML attribute enclosing the `{{draft}}` placeholder in a site-configured Draft List template, thereby escaping the attribute boundaries and injecting arbitrary HTML and JavaScript event handlers or script tags. The attack flow proceeds as follows: first, the Contributor creates or updates an unpublished draft containing the malicious payload within the post title. Second, an unprivileged site visitor or user requests a public-facing page that renders the Draft List widget or the `[drafts]` shortcode using a vulnerable template configuration. Third, the plugin processes the template, performs the `{{draft}}` substitution with the raw malicious post title, and outputs the rendered HTML to the victim's browser without neutralizing the injected markup. Finally, the browser parses the response, evaluates the injected JavaScript, and executes the payload in the context of the victim's active session, achieving stored XSS over the network. The affected versions comprise 2.6.3 and all prior versions, while version 2.6.4 introduces the necessary fixes to remediate the flaw."
}