dartiss draft-list vulnerabilities

Latest dartiss draft-list CVEs

Newest publication first

1. CVE-2026-49466 Draft List - Contributor Stored Cross-Site Scripting via Draft Title in Custom Drafts Template Attributes

   Published 2026-08-12

   Medium·CVSS 6.5 EPSS 0.29%

   Draft List is a WordPress plugin to manage and promote unpublished content. Versions 2.6.3 and below are vulnerable to stored Cross-Site Scripting (XSS) in the [drafts] shortcode and Draft List widget when the documented custom template option places the {{draft}} placeholder ins...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.