{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11197", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-30T18:17:57.713Z", "datePublished": "2025-10-11T07:25:56.898Z", "dateUpdated": "2026-04-08T16:49:56.047Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:49:56.047Z"}, "affected": [{"vendor": "dartiss", "product": "Draft List", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.6.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Draft List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'drafts' shortcode in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Draft List <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4711e3d5-b70c-413e-97e7-6d2e93e8217e?source=cve"}, {"url": "https://github.com/dartiss/draft-list/pull/81/files"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3376385%40simple-draft-list&new=3376385%40simple-draft-list&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Athiwat Tiprasaharn"}], "timeline": [{"time": "2025-09-30T18:33:28.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-10-10T19:04:54.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-14T13:31:33.453244Z", "id": "CVE-2025-11197", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-14T14:12:30.722Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11197", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-14T13:31:33.453244Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-14T13:31:35.332Z"}}], "cna": {"title": "Draft List <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "Athiwat Tiprasaharn"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "dartiss", "product": "Draft List", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "2.6.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-09-30T18:33:28.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-10-10T19:04:54.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4711e3d5-b70c-413e-97e7-6d2e93e8217e?source=cve"}, {"url": "https://github.com/dartiss/draft-list/pull/81/files"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3376385%40simple-draft-list&new=3376385%40simple-draft-list&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Draft List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'drafts' shortcode in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-10-11T07:25:56.898Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11197", "state": "PUBLISHED", "dateUpdated": "2025-10-14T14:12:30.722Z", "dateReserved": "2025-09-30T18:17:57.713Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-11T07:25:56.898Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Draft List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'drafts' shortcode in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "id": "CVE-2025-11197", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-10-11T08:15:31.967", "references": [{"source": "security@wordfence.com", "url": "https://github.com/dartiss/draft-list/pull/81/files"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3376385%40simple-draft-list&new=3376385%40simple-draft-list&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4711e3d5-b70c-413e-97e7-6d2e93e8217e?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T13:11:22.774759+00:00", "value": {"mitigation_remediation": ["Upgrade the Draft List plugin to version 2.6.2 or later, which removes the vulnerability.", "If an upgrade is not immediately possible, disable the 'drafts' shortcode or restrict its use to trusted users.", "Review user roles and ensure contributors have minimal permissions needed; consider revoking contributor access where not necessary."], "summary": {"action": "Apply patch", "impact": "Stored Cross\u2011Site Scripting leading to potential site compromise"}, "threat_synthesis": {"affected_systems": "Vulnerable versions are Draft List 2.6.1 and all earlier releases. The plugin can be installed on any WordPress site using the DartIss plug\u2011in, so any website running those versions is at risk.", "description_and_impact": "The Draft List plugin for WordPress contains a stored cross\u2011site scripting flaw in the 'drafts' shortcode because the plugin fails to sanitize or escape user\u2011supplied attributes. Authenticated users with contributor level or higher can inject arbitrary JavaScript that runs whenever the affected page is viewed, enabling defacement, cookie theft, or redirection to malicious sites.", "risk_and_exploitability": "Although the CVSS score of 6.4 classifies this as moderate severity and the EPSS score of less than 1% indicates a very low probability of automated exploitation, the vulnerability still permits an attacker who has been granted contributor permissions to inject code that all other site visitors will execute. Because the flaw is stored, the payload persists until the shortcode is removed or the site is patched. The vulnerability is not currently listed in CISA's KEV catalog, but because it requires authenticated access, the threat is limited to users with contributor or higher privileges."}}}}, "created": "2025-10-20T16:17:04.932113+00:00", "updated": "2026-04-22T13:15:17.849580+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}