CVE-2026-49466 dartiss CVE debrief

Who should care

WordPress site administrators and defenders should assess exposure and apply the patch, as the vulnerability allows for XSS attacks on unauthenticated users who visit pages with the Draft List widget or shortcode.

Why it matters

CVE-2026-49466 is a stored XSS vulnerability in the Draft List WordPress plugin that allows an authenticated Contributor to store malicious JavaScript code, which is executed on unauthenticated users who visit pages with the Draft List widget or shortcode. Defenders should prioritize verifying exposure and applying the patch to prevent exploitation.

• XSS attacks on unauthenticated users who visit pages with the Draft List widget or shortcode
• Potential for JavaScript execution, leading to unauthorized actions or data theft
• Need for verification of exposure and application of the patch to prevent exploitation
• Importance of sanitizing user-input data for the Draft List widget and shortcode

Technical summary

The Draft List WordPress plugin is vulnerable to stored Cross-Site Scripting (XSS) in the `[drafts]` shortcode and Draft List widget. The issue arises when a custom `template` option places the `{{draft}}` placeholder inside an HTML attribute. An authenticated Contributor can store a malicious title that breaks out of an attribute in a site-configured Draft List template, executing JavaScript for visitors who load the public page.

Defensive priority

Defenders should prioritize verifying exposure and applying the patch, as the vulnerability allows for XSS attacks on unauthenticated users.

Recommended defensive actions

• Verify if the Draft List plugin is installed and enabled on WordPress sites
• Check if the installed version is 2.6.3 or below
• Update to version 2.6.4 or later if vulnerable
• Review and sanitize user-input data for the Draft List widget and shortcode
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. The vendor has released a patched version (2.6.4) and provided source references for further information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.