CVE-2025-10181

The Draft List plugin for WordPress (up to version 2.6) is vulnerable to Stored Cross-Site Scripting (XSS) through its 'drafts' shortcode. The vulnerability arises from insufficient input sanitization and output escaping on user-supplied attributes, allowing malicious script injection [1][2].

Exploitation requires an authenticated user with at least contributor-level access. Attackers can inject arbitrary web scripts via crafted shortcode parameters. When other users, including administrators, view the page containing the malicious shortcode, the injected script executes in their browsers [1][2].

The impact includes theft of sensitive information (e.g., session cookies), defacement of the site, or performing privileged actions on behalf of the victim, potentially leading to complete site compromise [1][2].

Users should update to a patched version of the plugin as soon as possible. The vendor has likely addressed the issue in a newer release; no workaround is mentioned in the available references [1].