PT-2026-48554 · WordPress · Yoast Duplicate Post
CVE-2026-53740
·
Published
2026-06-10
·
Updated
2026-06-10
CVSS v3.1
5.4
Medium
| Vector | AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Yoast Duplicate Post versions prior to 4.7
Description
Stored Cross-Site Scripting occurs because the software inserts an unescaped post title and permalink into the Classic Editor scheduled republish notice. An attacker can schedule a republish copy using a crafted title to execute malicious scripts when an administrator views the notice.
Recommendations
Update to a version newer than 4.6.
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Yoast Duplicate Post