The Draft List plugin for WordPress contains a stored cross‑site scripting flaw in the 'drafts' shortcode because the plugin fails to sanitize or escape user‑supplied attributes. Authenticated users with contributor level or higher can inject arbitrary JavaScript that runs whenever the affected page is viewed, enabling defacement, cookie theft, or redirection to malicious sites.

Vulnerable versions are Draft List 2.6.1 and all earlier releases. The plugin can be installed on any WordPress site using the DartIss plug‑in, so any website running those versions is at risk.

Although the CVSS score of 6.4 classifies this as moderate severity and the EPSS score of less than 1% indicates a very low probability of automated exploitation, the vulnerability still permits an attacker who has been granted contributor permissions to inject code that all other site visitors will execute. Because the flaw is stored, the payload persists until the shortcode is removed or the site is patched. The vulnerability is not currently listed in CISA's KEV catalog, but because it requires authenticated access, the threat is limited to users with contributor or higher privileges.