CVE-2026-9104 — Cross-Site Scripting (XSS)

title: WordPress Draft List Plugin Stored XSS via Draft Post Title — CVE-2026-9104
id: scw-2026-05-22-ai-1
status: experimental
level: high
description: |
  Detects potential exploitation of CVE-2026-9104, a stored XSS vulnerability in the WordPress Draft List plugin. This rule looks for specific URL patterns associated with editing draft posts and the presence of common XSS script tags within the query parameters, indicating an attempt to inject malicious scripts into draft post titles.
author: SCW Feed Engine (AI-generated)
date: 2026-05-22
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-9104/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/wp-admin/post.php'
      cs-uri-query|contains:
          - 'action=edit'
      referer|contains:
          - '/wp-admin/post.php'
      cs-uri-query|contains:
          - 'post=' 
  selection_payload:
      cs-uri-query|contains:
          - '<script>alert(' 
      cs-uri-query|contains:
          - '</script>'
  condition: selection AND selection_payload
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse