CVE-2026-53740
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Yoast Duplicate Post through 4.6 inserts an unescaped post title and permalink into the Classic Editor scheduled republish notice. Attackers can schedule a republish copy with a crafted title to execute script when an administrator views the resulting notice.
Risk Assessment
XSS attack on an administrator can lead to account takeover and full compromise of the WordPress site.
Recommendation
Update the Yoast Duplicate Post plugin to version 4.7 or later.
Other vulnerabilities in Yoast Duplicate Post
Original NVD description (English source)
Yoast Duplicate Post through 4.6 inserts an unescaped post title and permalink into the Classic Editor scheduled republish notice. Attackers can schedule a republish copy with a crafted title to execute script when an administrator views the resulting notice.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS