CVE-2026-9104: Draft List Plugin for WordPress XSS Flaw

CVE-2026-9104 Overview

CVE-2026-9104 is a stored Cross-Site Scripting (XSS) vulnerability in the Draft List plugin for WordPress, affecting all versions up to and including 2.6.3. The flaw exists in how the plugin handles draft post titles, lacking proper input sanitization and output escaping. Authenticated attackers with author-level access or above can inject arbitrary JavaScript into draft post titles. The malicious payload executes in the browsers of users who view the rendered draft list, specifically those without edit capabilities such as subscribers and unauthenticated visitors. The vulnerability is tracked under CWE-79.

Critical Impact
Authenticated authors can inject persistent JavaScript that executes in the browsers of subscribers and unauthenticated visitors, enabling session theft, redirection, and unauthorized actions in the context of the affected WordPress site.

Affected Products

WordPress Draft List (Simple Draft List) plugin versions up to and including 2.6.3
Fixed in Draft List plugin version 2.6.4
Any WordPress installation with the vulnerable plugin enabled and accepting author-level registrations

Discovery Timeline

2026-05-22 - CVE-2026-9104 published to the National Vulnerability Database
2026-05-22 - Last updated in NVD database

Technical Details for CVE-2026-9104

Vulnerability Analysis

The Draft List plugin renders draft post titles into HTML output without applying adequate escaping. The plugin source at inc/create-lists.php in version 2.6.3 constructs output that incorporates the post title attribute without sanitization on lines 305, 396, and 66. When the viewing user lacks the edit_posts capability, the code path that emits the title does not pass it through WordPress escaping functions such as esc_attr() or esc_html().

Attacker-controlled markup in a draft title therefore reaches the DOM verbatim. The vendor remediated the flaw in version 2.6.4, adding escaping calls at inc/create-lists.php lines 389, 391, and 394.

Root Cause

The root cause is insufficient input sanitization on draft creation and missing output escaping on render. WordPress permits authors to submit post titles containing characters that are meaningful in HTML attribute context. The Draft List plugin then concatenates these titles into HTML without neutralizing quotes, angle brackets, or event handler syntax, satisfying the conditions for stored XSS per [CWE-79].

Attack Vector

An attacker with author-level access creates a draft post with a title crafted to break out of an HTML attribute and inject a script payload. The payload uses attribute-breakout techniques such as closing an existing attribute with a quote and introducing an event handler like onmouseover or onerror. When a subscriber or unauthenticated visitor loads a page rendering the Draft List output, the browser parses the injected attribute and executes the JavaScript. The Scope:Changed designation in the CVSS vector reflects that script execution occurs in the context of viewers who never interacted with the draft directly.

No verified public exploit code is available. See the Wordfence Vulnerability Analysis and the vulnerable source at line 305 for technical details.

Detection Methods for CVE-2026-9104

Indicators of Compromise

Draft posts with titles containing HTML characters such as ", <, >, or event handler strings like onerror=, onmouseover=, or <script
Unexpected outbound requests from visitor browsers to attacker-controlled domains following page loads that include the Draft List widget or shortcode
WordPress audit log entries showing draft creation or title edits by author-role accounts immediately followed by subscriber session anomalies

Detection Strategies

Query the wp_posts table for rows where post_status = 'draft' and post_title contains <, >, ", or javascript: substrings
Inspect rendered pages that include Draft List shortcodes or widgets for unescaped HTML in the title attribute
Review web server access logs for requests to pages containing Draft List output correlated with new author registrations or role changes

Monitoring Recommendations

Alert on creation of new WordPress accounts with author privileges or higher, particularly on sites that allow self-registration
Monitor Content Security Policy (CSP) violation reports for inline script execution on pages where Draft List output appears
Track plugin version inventory across WordPress estates and flag any host still running Draft List 2.6.3 or earlier

How to Mitigate CVE-2026-9104

Immediate Actions Required

Update the Draft List plugin to version 2.6.4 or later on all WordPress installations
Audit existing draft post titles for HTML or script content and sanitize or remove any suspicious entries
Review the user list for unauthorized author-level accounts and revoke unnecessary publishing privileges

Patch Information

The vendor released Draft List 2.6.4, which adds output escaping at inc/create-lists.php lines 389, 391, and 394. Compare the patched source against the vulnerable source to verify the fix. Apply the update through the WordPress admin Plugins screen or via WP-CLI.

Workarounds

Temporarily deactivate the Draft List plugin until the update can be applied
Restrict author-level role assignment to trusted users only and disable open registration
Deploy a Web Application Firewall (WAF) rule that blocks requests submitting post titles containing <script, onerror=, or other event handler patterns
Implement a strict Content Security Policy that disallows inline scripts and event handler attributes on front-end pages

bash

# Update the Draft List plugin using WP-CLI
wp plugin update simple-draft-list --version=2.6.4

# Verify the installed version
wp plugin get simple-draft-list --field=version

# Audit draft titles for suspicious content
wp db query "SELECT ID, post_title, post_author FROM wp_posts WHERE post_status='draft' AND (post_title LIKE '%<%' OR post_title LIKE '%onerror%' OR post_title LIKE '%javascript:%');"