CVE-2026-4006

The Simple Draft List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' post meta (Custom Field) in all versions up to and including 2.6.2. This is due to insufficient input sanitization and output escaping on the author display name when no author URL is present. The plugin accesses `$draft_data->display_name` which, because `display_name` is not a native WP_Post property, triggers WP_Post::__get() and resolves to `get_post_meta($post_id, 'display_name', true)`. When the `user_url` meta field is empty, the `$author` value is assigned to `$author_link` on line 383 without any escaping (unlike line 378 which uses `esc_html()` for the `{{author}}` tag, and line 381 which uses `esc_html()` when a URL is present). This unescaped value is then inserted into the shortcode output via `str_replace()`. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses a page containing the `[drafts]` shortcode with the `{{author+link}}` template tag.

• CWE-79

• https://plugins.trac.wordpress.org/browser/simple-draft-list/tags/2.6.2/inc/create-lists.php#L344
• https://plugins.trac.wordpress.org/browser/simple-draft-list/tags/2.6.2/inc/create-lists.php#L383
• https://plugins.trac.wordpress.org/browser/simple-draft-list/trunk/inc/create-lists.php#L344
• https://plugins.trac.wordpress.org/browser/simple-draft-list/trunk/inc/create-lists.php#L383
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3482945%40simple-draft-list&new=3482945%40simple-draft-list&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/b5f0dc1a-6b6a-4370-a368-3687cffb43fc?source=cve

Published

Mar 19, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40045OpenClaw before 2026.4.2 accepts non-loopback cleartext ws:/…5.9
• CVE-2026-40046Integer Overflow or Wraparound vulnerability in Apache Activ…7.5
• CVE-2026-40047Improper Neutralization of Argument Delimiters in a Command …9.1
• CVE-2026-40048The Camel-PQC FileBasedKeyLifecycleManager class deserialize…7.8
• CVE-2026-4005The Coachific Shortcode plugin for WordPress is vulnerable t…6.4
• CVE-2026-40050CrowdStrike has released security updates to address a criti…9.8
• CVE-2026-40060When a BIG-IP Advanced WAF or ASM security policy is configu…8.7
• CVE-2026-40061When BIG-IP DNS is provisioned, a vulnerability exists in an…8.7
• CVE-2026-40062A path Traversal vulnerability exists in Ziostation2 v2.9.8.…8.7
• CVE-2026-40066Anviz CX2 Lite and CX7 are vulnerable to unverified update p…8.8
• CVE-2026-40067When a BIG-IP APM access policy is configured on a virtual s…8.7
• CVE-2026-40068In versions 2.1.63 through 2.1.83 of Claude Code, the folder…8.8