Stored XSS occurs when the Draft List shortcode or widget uses a custom template that places the {{draft}} placeholder inside an HTML attribute. A Contributor can save a title containing an attribute‑breaking payload, which the plugin later inserts without escaping for users who cannot edit posts. The result is that visitors see the page load with arbitrary JavaScript, enabling cookie theft, session hijacking, or other client‑side exploitation consistent with Web‑Application Attacks.

The vulnerability affects the Dartiss Draft List WordPress plugin, versions 2.6.3 and earlier. Any site using these plugin versions and a custom template that includes the {{draft}} placeholder inside an attribute is susceptible.

The CVSS base score of 6.5 indicates moderate severity. The EPSS score is not available, and the issue is not listed in KEV. Attackers need only the Contributor role and the ability to edit a draft title; once the title is stored, all public visitors to pages rendering the shortcode or widget can be affected. The risk is therefore high for sites that expose the affected shortcode to unauthenticated users.