The Draft List WordPress plugin contains a stored Cross‑Site Scripting flaw caused by inadequate sanitization of user‑supplied attributes used in its 'drafts' shortcode. Attackers who have contributor‑level or higher permissions can insert malicious JavaScript that is persisted in the page content. When any user views the affected page, the injected script runs in that user's browser, potentially allowing session hijacking, defacement, or theft of sensitive data. This is a CWE‑79 vulnerability and represents a moderate‑to‑high threat to the confidentiality and integrity of visitor data.

The vulnerability impacts any WordPress site running the Draft List plugin version 2.6 or earlier from vendor dartiss. Sites using older releases that have not been upgraded remain susceptible.

The CVSS score is 6.4 indicating a moderate severity. EPSS is below 1 %, showing a very low probability of exploitation at this time. The vulnerability is not listed in CISA KEV and does not provide a remote code execution path; however, it can be abused by any authenticated contributor member. The attack vector requires the attacker to have contributor or higher privileges to insert or edit content containing the malicious shortcode. Success is straightforward once permissions are owned, and the injected script will execute automatically for all visitors to the affected page.