Security readout for executives and security teams
Plain-English summary
CVE-2026-4006 is a stored cross-site scripting issue in the Simple Draft List WordPress plugin up to version 2.6.2. A logged-in Contributor or higher could save malicious script content that runs for visitors viewing a page using the vulnerable drafts shortcode template. Business risk is moderate because exploitation requires an authenticated account, but impact can reach site users and administrators.
Executive priority
Treat as a near-term WordPress hygiene fix, not an emergency unless untrusted users can submit drafts. Prioritize sites with public contributor programs, many authors, or administrator traffic to pages showing draft lists. Confirm plugin status, reduce unnecessary author privileges, and apply vendor updates when available.
Technical view
The flaw is insufficient sanitization and output escaping of the author display name when the author URL is empty. The plugin reads display_name from post meta through WP_Post::__get(), assigns it to author_link without escaping, and injects it into shortcode output via str_replace(). The vulnerable rendering path involves the [drafts] shortcode with the {{author+link}} template tag.
Likely exposure
Exposure is likely limited to WordPress sites running Simple Draft List/Draft List through version 2.6.2, with untrusted Contributor-level or higher users, and pages rendering the [drafts] shortcode using {{author+link}}. Sites without the plugin, without that shortcode/template use, or without lower-privileged authors have reduced exposure.
Exploitation context
The CVE is not listed in KEV, and the provided sources do not state active exploitation. The issue is remotely reachable through normal WordPress authenticated content workflows, requires low privileges, and triggers when a user visits affected shortcode output. It can support session theft, content manipulation, or phishing in the victim’s browser context.
Researcher notes
The vulnerable branch differs from nearby escaped output: {{author}} and URL-present author link paths use esc_html(), but the no-URL author_link assignment is unescaped at the cited line. The provided changeset and trunk references should be reviewed to understand remediation, but the supplied data does not clearly name a fixed release version.
Mitigation direction
- Inventory WordPress sites for Simple Draft List/Draft List versions up to 2.6.2.
- Check the WordPress plugin repository and vendor guidance for a fixed release.
- Update the plugin if a patched version is available from trusted sources.
- Restrict Contributor and higher accounts to trusted users until remediated.
- Remove or avoid {{author+link}} in [drafts] shortcode templates where feasible.
- Review draft custom fields for suspicious display_name values.
Validation and detection
- Confirm whether the Simple Draft List/Draft List plugin is installed and active.
- Record the installed plugin version and compare it with 2.6.2.
- Identify pages or posts containing the [drafts] shortcode.
- Check shortcode templates for use of {{author+link}}.
- Review users with Contributor, Author, Editor, or Administrator roles.
- Inspect relevant draft post meta for unexpected display_name content.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-4006 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N3.12.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.4MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/b5f0dc1a-6b6a-4370-a368-3687cffb43fc?source=cveCVE reference
- https://plugins.trac.wordpress.org/browser/simple-draft-list/tags/2.6.2/inc/create-lists.php#L383CVE reference
- https://plugins.trac.wordpress.org/browser/simple-draft-list/trunk/inc/create-lists.php#L383CVE reference
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3482945%40simple-draft-list&new=3482945%40simple-draft-list&sfp_email=&sfph_mail=CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.