CVSS 4.0
4.8 mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:NCVE-2019-25314
Medium (4.8). EPSS 0.2% chance of exploitation in the next 30 days.
Yoast Duplicate-Post WordPress Plugin 3.2.3 contains a persistent cross-site scripting vulnerability in plugin settings parameters. Attackers can inject malicious scripts into title prefix, suffix, menu order, and blacklist fields to execute arbitrary JavaScript in admin interfaces.
Severity
CVSS 3.1
5.5 mediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 15% of CVEs (scores of 2026-10-31)
- Published
- Modified
- Record from
- the NVD, synced
References
- https://duplicate-post.lopo.it/
- https://wordpress.org/plugins/duplicate-post/
- https://www.exploit-db.com/exploits/47424
- https://www.vulncheck.com/advisories/duplicate-post-persistent-cross-site-scripting
- https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/duplicate-post/yoast-duplicate-post-323-authenticated-admin-stored-cross-site-scripting