Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-10-01
Duplicate Post - Security Vulnerability (CVE-2026-89424)
The Duplicate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'noti_token' parameter in all versions up to, and including, 1.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires that the site owner has enabled the plugin's User Level Permissions for the Subscriber role, as this grants access to the i_saw_this_noti AJAX branch needed to deliver…
PLUGIN
Duplicate Post
CVE-2026-89424
Risk Score
Threat Entry
Updated 2026-08-26
Duplicate Post - Broken Access Control (CVE-2026-19435)
The Duplicate Post WordPress plugin before 1.5.6 does not check the user's capabilities before returning post data, allowing users with a delegated role to read the content, metadata and passwords of posts they are not allowed to access, including other users' private and draft content.
PLUGIN
Duplicate Post
CVE-2026-19435
Risk Score
Threat Entry
Updated 2026-08-26
Duplicate Post - Security Vulnerability (CVE-2026-19085)
The Duplicate Post WordPress plugin before 1.5.6 does not check that a user may read the content of a post before duplicating it, allowing users with a delegated role to republish another user's password-protected post as publicly readable.
PLUGIN
Duplicate Post
CVE-2026-19085
Risk Score
Threat Entry
Updated 2026-08-26
Duplicate Post - Security Vulnerability (CVE-2026-19077)
The Duplicate Post WordPress plugin before 1.5.5 does not perform per-object authorisation checks in its bulk copy and delete operations, allowing any user whose role an administrator has granted Duplicate Post WordPress plugin before 1.5.5 access to permanently delete arbitrary posts on the site, including those belonging to other users.
PLUGIN
Duplicate Post
CVE-2026-19077
Risk Score
Threat Entry
Updated 2026-07-23
Duplicate Post - Security Vulnerability (CVE-2026-53740)
Yoast Duplicate Post through 4.6 inserts an unescaped post title and permalink into the Classic Editor scheduled republish notice. Attackers can schedule a republish copy with a crafted title to execute script when an administrator views the resulting notice.
PLUGIN
Duplicate Post
CVE-2026-53740
Risk Score
Threat Entry
Updated 2026-07-23
Duplicate Post - Cross-Site Request Forgery (CSRF) (CVE-2026-53739)
Yoast Duplicate Post through 4.6 contains a cross-site request forgery vulnerability in the duplicate_post_dismiss_notice handler, which verifies no nonce or capability. Attackers can trick any authenticated user into sending a request that sets the duplicate_post_show_notice site option, suppressing admin notices network-wide.
PLUGIN
Duplicate Post
CVE-2026-53739
Risk Score
Threat Entry
Updated 2026-06-17
Duplicate Post - Broken Access Control (CVE-2026-1217)
The Yoast Duplicate Post plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the clone_bulk_action_handler() and republish_request() functions in all versions up to, and including, 4.5. This makes it possible for authenticated attackers, with Contributor-level access and above, to duplicate any post on the site including private, draft, and trashed posts they shouldn't have access to. Additionally, attackers with Author-level access and above can use the Rewrite & Republish feature to overwrite any published post with their own content.
PLUGIN
Duplicate Post
CVE-2026-1217
Risk Score
Threat Entry
Updated 2026-06-17
Duplicate Post - Cross-Site Scripting (XSS) (CVE-2019-25314)
Yoast Duplicate-Post WordPress Plugin 3.2.3 contains a persistent cross-site scripting vulnerability in plugin settings parameters. Attackers can inject malicious scripts into title prefix, suffix, menu order, and blacklist fields to execute arbitrary JavaScript in admin interfaces.
PLUGIN
Duplicate Post
CVE-2019-25314
Risk Score
Threat Entry
Updated 2026-06-17
Duplicate Post - Cross-Site Request Forgery (CSRF) (CVE-2023-3977)
Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missing nonce check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for unauthenticated attackers to install plugins from the limited list via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Duplicate Post
CVE-2023-3977
Risk Score
Threat Entry
Updated 2026-06-17
Duplicate Post - Broken Access Control (CVE-2023-0958)
Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for authenticated attackers with minimal permissions, such as subscribers, to install select plugins from Inisev on vulnerable sites. CVE-2023-38514 appears to be a duplicate of this vulnerability.
PLUGIN
Duplicate Post
CVE-2023-0958
Risk Score
Threat Entry
Updated 2026-06-17
Duplicate Post - SQL Injection (CVE-2021-43408)
The "Duplicate Post" WordPress plugin up to and including version 1.1.9 is vulnerable to SQL Injection. SQL injection vulnerabilities occur when client supplied data is included within an SQL Query insecurely. SQL Injection can typically be exploited to read, modify and delete SQL table data. In many cases it also possible to exploit features of SQL server to execute system commands and/or access the local file system. This particular vulnerability can be exploited by any authenticated user who has been granted access to use the Duplicate Post plugin. By default,…
PLUGIN
Duplicate Post
CVE-2021-43408
Risk Score