The Simple Draft List WordPress plugin contains a stored Cross‑Site Scripting vulnerability (CWE‑79). The flaw originates when the plugin retrieves the author display name from a custom field named 'display_name' and, if the author URL is empty, outputs this value directly into the shortcode result without escaping (CVE Description). An attacker with Contributor or higher permissions can store malicious JavaScript in that field, which will execute whenever a visitor loads a page that contains the [drafts] shortcode with the {{author+link}} template tag. This can lead to session hijacking, defacement, or arbitrary code execution within the context of the visiting user.

All installations of the Simple Draft List plugin distributed by dartiss, version 2.6.2 or earlier, are affected. No specific version numbers beyond 2.6.2 are listed, so any earlier release inherits the same flaw (Known CNA Affected Version).

The base CVSS score of 6.4 indicates a medium severity vulnerability (CVSS). The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog (KEV: not listed). Based on the description, the likely attack vector is an authenticated local CMS attacker with Contributor or higher access, making this a local CMS–based attack. While no public exploit code is currently published, any authenticated contributor or higher who can edit the 'display_name' field could inject and activate malicious scripts on the front‑end (CVE Description).