CVE-2026-4006 PUBLISHED

Draft List <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'display_name' Parameter

Assigner: Wordfence
Reserved: 11.03.2026 Published: 19.03.2026 Updated: 19.03.2026

The Simple Draft List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' post meta (Custom Field) in all versions up to and including 2.6.2. This is due to insufficient input sanitization and output escaping on the author display name when no author URL is present. The plugin accesses $draft_data->display_name which, because display_name is not a native WP_Post property, triggers WP_Post::__get() and resolves to get_post_meta($post_id, 'display_name', true). When the user_url meta field is empty, the $author value is assigned to $author_link on line 383 without any escaping (unlike line 378 which uses esc_html() for the {{author}} tag, and line 381 which uses esc_html() when a URL is present). This unescaped value is then inserted into the shortcode output via str_replace(). This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses a page containing the [drafts] shortcode with the {{author+link}} template tag.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CVSS Score: 6.4

Product Status

Vendor dartiss
Product Draft List
Versions Default: unaffected
  • affected from * to 2.6.2 (incl.)

Credits

  • Anas Mokhtari finder
  • Abdelkhalek Beraoud finder

References

Problem Types

  • CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE