yoast/duplicate-post vulnerabilities

Latest yoast/duplicate-post CVEs

Newest publication first

1. CVE-2026-1217 Yoast Duplicate Post <= 4.5 - Authenticated (Contributor+) Missing Authorization to Arbitrary Post Duplication and Overwrite

   Published 2026-03-18

   Medium·CVSS 5.4 EPSS 0.18%

   The Yoast Duplicate Post plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the clone_bulk_action_handler() and republish_request() functions in all versions up to, and including, 4.5. This makes it possible for authentica...

2. CVE-2019-25314 Duplicate-Post 3.2.3 - Persistent Cross-Site Scripting

   Published 2026-02-11

   Medium·CVSS 4.8 EPSS 0.25%

   Yoast Duplicate-Post WordPress Plugin 3.2.3 contains a persistent cross-site scripting vulnerability in plugin settings parameters. Attackers can inject malicious scripts into title prefix, suffix, menu order, and blacklist fields to execute arbitrary JavaScript in admin interfac...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.