CVE-2026-66603 Overview
CVE-2026-66603 is a stored cross-site scripting (XSS) vulnerability in the David Artiss Draft List WordPress plugin (simple-draft-list). The flaw affects all versions up to and including 2.6.4. It results from improper neutralization of input during web page generation [CWE-79]. An authenticated attacker with low privileges can inject malicious script content that persists in the application. The payload executes in the browser of any user who views the affected page, enabling session theft, account takeover, or redirection to attacker-controlled infrastructure.
Critical Impact
Authenticated attackers can inject persistent JavaScript that executes across privilege boundaries, changing the security scope of the affected component.
Affected Products
- David Artiss Draft List (simple-draft-list) WordPress plugin
- All versions from n/a through 2.6.4
- WordPress sites with the plugin installed and activated
Discovery Timeline
- 2026-08-18 - CVE-2026-66603 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-66603
Vulnerability Analysis
The Draft List plugin fails to properly sanitize or encode user-supplied input before rendering it in generated web pages. This weakness maps to [CWE-79], Improper Neutralization of Input During Web Page Generation. Because the payload is stored server-side, it executes each time a victim loads the affected view. The scope change indicated in the CVSS vector reflects that injected script runs in the browser context of other users, including administrators. This transitions the impact from the vulnerable plugin to the entire WordPress session and DOM.
Root Cause
The root cause is missing or insufficient output encoding when the plugin renders draft-related data supplied by an authenticated contributor-level user. The plugin trusts stored input and emits it into HTML context without escaping HTML metacharacters. Standard WordPress helpers such as esc_html(), esc_attr(), and wp_kses_post() are not consistently applied on the affected rendering paths.
Attack Vector
Exploitation requires an authenticated user with low privileges and user interaction from the victim who loads the injected content. An attacker submits a draft or related field containing a JavaScript payload. The plugin stores the payload and later renders it verbatim in a page viewed by other users, including administrators. Successful exploitation can lead to cookie theft, forced administrative actions via forged requests, or delivery of secondary malware. Refer to the Patchstack Vulnerability Report for additional technical detail.
Detection Methods for CVE-2026-66603
Indicators of Compromise
- Unexpected <script>, onerror=, or onload= attributes stored in draft post metadata or plugin-managed database tables.
- Outbound requests from administrator browsers to unfamiliar domains shortly after loading WordPress admin pages that render draft lists.
- New or modified WordPress administrator accounts created without a corresponding legitimate audit trail.
Detection Strategies
- Audit wp_posts and plugin-specific tables for HTML event handlers or <script> tags in fields exposed by the Draft List plugin.
- Review WordPress access logs for POST requests to draft-editing endpoints originating from contributor-level or higher accounts.
- Monitor browser console errors and Content Security Policy violation reports on pages that render the plugin's draft list output.
Monitoring Recommendations
- Enable and forward WordPress audit logs to a centralized log platform for correlation across authenticated user actions.
- Alert on any modification of user roles or capabilities that follows a session viewing a draft list page.
- Track plugin version inventory across managed WordPress sites and flag installations running simple-draft-list at version 2.6.4 or earlier.
How to Mitigate CVE-2026-66603
Immediate Actions Required
- Update the Draft List plugin to a version later than 2.6.4 as soon as the vendor publishes a fixed release.
- Restrict contributor and author account creation and review existing low-privileged accounts for suspicious activity.
- Deploy a web application firewall (WAF) rule to block common XSS payloads submitted to WordPress editing endpoints.
Patch Information
At the time of publication, the vendor advisory tracked by the Patchstack Vulnerability Report lists affected versions through 2.6.4. Administrators should monitor the WordPress plugin repository for a patched release and apply it immediately upon availability.
Workarounds
- Deactivate and remove the simple-draft-list plugin until a patched version is available.
- Enforce a strict Content Security Policy that disallows inline scripts on WordPress admin and public pages.
- Limit publishing and draft-editing capabilities to trusted accounts protected by multi-factor authentication.
# Configuration example: disable the plugin from WP-CLI until a patch is released
wp plugin deactivate simple-draft-list
wp plugin delete simple-draft-list
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
