CVE-2026-49466
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Aug 12, 2026
Vendor
unknown
Description
Draft List is a WordPress plugin to manage and promote unpublished content. Versions 2.6.3 and below are vulnerable to stored Cross-Site Scripting (XSS) in the `[drafts]` shortcode and Draft List widget when the documented custom `template` option places the `{ {draft} }` placeholder inside an HTML attribute. The vulnerable code inserts the raw draft `post_title` into `{ {draft} }` when the current viewer cannot edit posts. Because the template is sanitized before `{ {draft} }` replacement, a Contributor can store a quote-only title payload that breaks out of an attribute in a site-configured Draft List template and executes JavaScript for visitors who load the public page. Version 2.6.4 fixes the issue.