The Draft List WordPress plugin allows authenticated users with author or higher privileges to store arbitrary code in draft post titles. When a user who cannot edit the draft views the page, the title is rendered without proper escaping, causing the injected script to execute in the visitor’s browser. This leads to a classic cross‑site scripting flaw (CWE‑79) that can hijack sessions, steal cookies, or deface the page for all users who encounter the injected title, including unauthenticated visitors and subscribers.

The vulnerability affects the Draft List plugin for WordPress versions up to and including 2.6.3. Users running any of these releases are at risk until they update to a patched version.

The CVSS score of 6.4 indicates a moderate severity, and the lack of EPS rating suggests low exploitation probability at present. The flaw is not listed in CISA’s KEV catalog. Attackers must first authenticate as authors or higher to inject the payload, but any visitor to a page that displays the malicious title will be victimized. The impact is broad and can affect all site users without remedial action. Although the exploit requires author privileges, it can be leveraged to compromise the wider site audience.