CVE-2026-4006
The Simple Draft List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' post meta (Custom Field) in all versions up to and including 2.6.2.
Published Mar 19, 2026 · updated Jun 17, 2026
The Simple Draft List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' post meta (Custom Field) in all versions up to and including 2.6.2. This is due to insufficient input sanitization and output escaping on the author display name when no author URL is present. The plugin accesses which, because is not a native WP_Post property, triggers WP_Post::__get() and resolves to . When the meta field is empty, the value is assigned to on line 383 without any escaping (unlike line 378 which uses for the tag, and line 381 which uses when a URL is present). This unescaped value is then inserted into the shortcode output via . This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses a page containing the shortcode with the template tag.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 19, 2026 · NIST NVD
Detected
The Simple Draft List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' post meta (Custom Field) in all versions up to and including 2.6.2. This is due to insufficient input sanitization and output escaping on the author display name when no author URL is present. The plugin accesses which, because is not a native WP_Post property, triggers WP_Post::__get() a
Jun 17, 2026 · NIST NVD
Updated
The Simple Draft List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' post meta (Custom Field) in all versions up to and including 2.6.2. This is due to insufficient input sanitization and output escaping on the author display name when no author URL is present. The plugin accesses which, because is not a native WP_Post property, triggers WP_Post::__get() a
Sources
- CVE.orgVulnerability recordCVE-2026-4006
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-4006
The Simple Draft List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' post meta (Custom Field) in all versions up to and including 2.6.2. This is due to insufficient input sanitization and output escaping on the author display name when no
nvd.nist.gov