Draft Notify
Draft Notify has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 4.4, and the most serious one scores 4.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Draft Notify has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.
All of these findings were reported by Muhammad Nur Ibnu Hubab. Draft Notify is installed on roughly 90 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 4.9.31.
CVE-2025-67627Draft Notify <= 1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records
Draft Notify
Author
TouchOfTech
I run multiple blogs and have the ability for people to sign up and write content for me. I was disappointed that WordPress does not have anything built it to alert me with an email notification when a new author writes something. I don�t log into the sites unless I have to, so new content may sit for a while without being noticed. I did find 1 plugin that would accomplish the email, but it was buggy. So I�ve written my own and am willing to share it with you. Specifically this plugin is designed to email you when an author saves a draft. Now there are some additional settings, but check them out below. As always, suggestions are welcome, just leave them in the comments along with any bugs you might encounter. Draft Notify Features Emails when a Draft is saved. Can email a specific email address or all users above a certain access level. Can email out whenever a revision is saved, or it can ignore revisions and only email when the first draft is saved.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C