VulnerabilityDeferred

CVE-2026-53740

Attackers can schedule a republish copy with a crafted title to execute script when an administrator views the resulting notice.

MEDIUM 5.1EPSS 0.14%

Does this matter?

Lower severity and a low EPSS score (0.14%). Track it; it rarely justifies an emergency change on its own.

Description

Yoast Duplicate Post through 4.6 inserts an unescaped post title and permalink into the Classic Editor scheduled republish notice. Attackers can schedule a republish copy with a crafted title to execute script when an administrator views the resulting notice.

CVSS 4.0: 5.1 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.14% probability · 4th percentile
CISA KEV: Not listed
Weakness: CWE-79
Source: disclosure@vulncheck.com

References

https://wordpress.org/plugins/duplicate-post/
https://www.vulncheck.com/advisories/yoast-duplicate-post-through-stored-cross-site-scripting-via-scheduled-republish-notice

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.