CVE-2026-66603

MediumCVSS 6.5

Published: 18/08/2026(UTC)Updated: 19/08/2026(UTC)Translated: 19/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

6th percentile - higher than 6% of all known CVEs

Summary

Cross-site Scripting (XSS) vulnerability in the Draft List plugin (simple-draft-list) allows stored XSS. Versions up to 2.6.4 are affected.

Risk Assessment

Risk of executing malicious script in the browser of an administrator or user, potentially leading to session theft or content modification.

Recommendation

Update the Draft List plugin to a version newer than 2.6.4 if a fix is available.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Artiss Draft List simple-draft-list allows Stored XSS. This issue affects Draft List: from n/a through 2.6.4.