Simple Draft List Vulnerabilities

The Draft List plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.6.4. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts i...

CVSS:

6.4

Affected:

up to 2.6.4

Fixed in:

2.6.5

Disclosed:

Aug 18, 2026

CVE-2026-66603 on NVD →

The Draft List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Draft Post Title in all versions up to, and including, 2.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web sc...

CVSS:

6.4

Affected:

2.6.3 – 2.6.3

Fixed in:

2.6.4

Disclosed:

May 21, 2026

CVE-2026-9104 on NVD →

Authenticated (Contributor+) Stored Cross-Site Scripting via 'display_name' Parameter vulnerability

CVSS:

5.9

Affected:

up to 2.6.2

Fixed in:

2.6.3

Disclosed:

Mar 19, 2026

The Simple Draft List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' post meta (Custom Field) in all versions up to and including 2.6.2. This is due to insufficient input sanitization and output escaping on the author display name when no author URL is present. The plugin acces...

CVSS:

6.4

Affected:

up to 2.6.2

Fixed in:

2.6.3

Disclosed:

Mar 18, 2026

CVE-2026-4006 on NVD →

[en] The Draft List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'drafts' shortcode in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contribut...

Affected:

up to 2.6.2

Fixed in:

2.6.2

Disclosed:

Oct 11, 2025

CVE-2025-11197 on NVD →

The Draft List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'drafts' shortcode in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-le...

CVSS:

6.4

Affected:

up to 2.6.1

Fixed in:

2.6.2

Disclosed:

Oct 10, 2025

CVE-2025-11197 on NVD →

The Draft List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'drafts' shortcode in all versions up to, and including, 2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-leve...

CVSS:

6.4

Affected:

up to 2.6

Fixed in:

2.6.1

Disclosed:

Sep 19, 2025

CVE-2025-10181 on NVD →

Affected:

up to 2.6.1

Fixed in:

2.6.1

CVE-2025-10181 on NVD →