Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Artiss Draft List simple-draft-list allows Stored XSS. This issue affects Draft List: from n/a through 2.6.4.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-18T22:17:25.313Z",
  "pubdate": "2026-08-18T22:17:25.313Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists in the Draft List plugin, specifically classified under CWE-79 as Improper Neutralization of Input During Web Page Generation. The vulnerability affects the David Artiss Draft List product from versions n/a through 2.6.4. The flaw allows authenticated or otherwise capable threat actors to inject arbitrary malicious scripts into web pages generated by the application, leading to Stored XSS conditions. The impact of this security deficiency includes session hijacking, unauthorized access to sensitive application data, and the execution of arbitrary client-side code within the context of a victim's browser session whenever they view the compromised web page. Risk implications are significant for installations utilizing the affected versions, as successful exploitation compromises the integrity and confidentiality of user interactions with the vulnerable WordPress plugin. The vulnerability stems from a failure to properly sanitize or neutralize user-supplied input before rendering it on the web page. Remediation requires updating the affected component to a patched version once available or applying rigorous input validation and output encoding mechanisms to neutralize potential script payloads.",
  "technicalDetails": "The vulnerability resides in the David Artiss Draft List simple-draft-list plugin, affecting all versions from n/a through 2.6.4. The root cause of the security issue is improper neutralization of input during web page generation, which directly leads to a Stored Cross-Site Scripting (XSS) vulnerability. The application fails to adequately sanitize, validate, or encode user-supplied data before storing it within the database or rendering it back to the client via the web interface. Attack flow begins when an attacker crafts a malicious payload containing executable JavaScript or HTML tags. This payload is submitted through an input vector handled by the Draft List plugin and is subsequently persisted by the application backend without proper sanitization. When a legitimate user or administrator navigates to the affected web page where the stored list data is retrieved and rendered, the malicious payload is served as part of the document object model (DOM). The victim's browser interprets the injected payload as legitimate application code and executes it within the security context of the victim's session. Depending on the privileges of the viewing user, this execution can facilitate post-exploitation activities such as session token theft, DOM manipulation, forced redirection to malicious external sites, or the execution of unauthorized administrative actions via the application interface. The vulnerable component processes and reflects stored entries without implementing contextual output encoding or strict input filtering protocols. Network exposure is inherent to web applications utilizing the plugin, and exploitation relies on the application's failure to enforce defense-in-depth principles regarding data rendering and input handling."
}