CVE-2025-11197: WordPress Draft List Plugin XSS Vulnerability

CVE-2025-11197 Overview

CVE-2025-11197 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Draft List plugin for WordPress. The flaw affects all versions up to and including 2.6.1. It stems from insufficient input sanitization and output escaping on user-supplied attributes passed to the plugin's drafts shortcode.

Authenticated users with contributor-level access or higher can inject arbitrary JavaScript into WordPress pages. The injected script executes in the browser of any visitor who accesses the affected page, including administrators.

Critical Impact
Contributor-level accounts can plant persistent JavaScript that executes against administrators, enabling session theft, account takeover, and further site compromise.

Affected Products

WordPress Draft List plugin (also referenced as simple-draft-list)
All versions up to and including 2.6.1
WordPress sites permitting contributor-level or higher registrations

Discovery Timeline

2025-10-11 - CVE-2025-11197 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11197

Vulnerability Analysis

The Draft List plugin exposes a drafts shortcode that renders lists of draft posts on WordPress pages. Shortcode attributes supplied by post authors are rendered into page output without sufficient sanitization or escaping.

Because WordPress permits contributors to author posts and use shortcodes, a low-privileged attacker can embed the drafts shortcode with malicious attribute values. When the affected page is viewed, the browser interprets the attacker-controlled string as JavaScript rather than data.

Stored XSS in a WordPress context is particularly consequential. Administrators who preview or review contributor submissions become targets, and payloads can invoke the WordPress REST API to create administrative accounts, install plugins, or exfiltrate content.

Root Cause

The shortcode handler fails to apply escaping functions such as esc_attr() or esc_html() to attribute values before writing them into HTML output. Input sanitization on the write path is also insufficient, allowing script-bearing strings to persist in post content.

Attack Vector

Exploitation requires an authenticated session with contributor privileges or higher. The attacker submits a post or page containing the drafts shortcode with a crafted attribute value. Once the content is rendered—during preview, publication, or administrator review—the payload executes in the victim's browser session. Refer to the Wordfence Vulnerability Report and the GitHub Pull Request Files for technical details on the affected code path.

Detection Methods for CVE-2025-11197

Indicators of Compromise

Draft List plugin version 2.6.1 or earlier installed on WordPress
Post or page content containing [drafts ...] shortcodes with attribute values that include <script>, javascript:, or event handlers such as onerror= and onload=
Unexpected administrative account creation or plugin installations following contributor activity
Outbound HTTP requests from administrator browsers to unfamiliar domains after viewing contributor content

Detection Strategies

Query the wp_posts table for shortcode usage combined with suspicious HTML characters in attributes
Review the plugin's changeset history via the WordPress Plugin Changeset reference to identify vulnerable code paths
Enable a web application firewall (WAF) rule that inspects POST requests to wp-admin/post.php for script tags within shortcode attributes

Monitoring Recommendations

Audit contributor and author accounts for anomalous post creation patterns
Monitor WordPress admin sessions for unexpected REST API calls to /wp-json/wp/v2/users and /wp-json/wp/v2/plugins
Log and alert on plugin installations, user role changes, and option modifications executed from browser sessions

How to Mitigate CVE-2025-11197

Immediate Actions Required

Update the Draft List plugin to a version later than 2.6.1 as published by the maintainer
Audit existing draft and published content for the [drafts] shortcode containing suspicious attribute values
Review recent administrator activity and rotate credentials for any account that viewed compromised pages
Restrict contributor-level account registration where not operationally required

Patch Information

The maintainer addressed the flaw in the plugin repository. See the GitHub Pull Request Files for the corrective changes and the WordPress Plugin Changeset for the published release, which introduces proper escaping of shortcode attributes.

Workarounds

Deactivate the Draft List plugin until patched versions are installed
Remove contributor-level shortcode privileges by filtering shortcodes out of non-administrator content via a the_content filter
Deploy a WAF signature that blocks shortcode attributes containing <, >, or javascript: tokens
Implement a Content Security Policy (CSP) that disallows inline script execution on the WordPress front end

bash

# Configuration example
wp plugin deactivate simple-draft-list
wp plugin update simple-draft-list