Stored Cross-Site Scripting Vulnerability in Duplicate Post Plugin by WordPress

CVE-2026-89424

What is CVE-2026-89424?

The Duplicate Post plugin for WordPress, up to version 1.5.6, is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping in the 'noti_token' parameter. This vulnerability allows authenticated attackers with subscriber-level access or higher to inject malicious web scripts into pages. When these pages are accessed, the injected scripts run, potentially compromising user data and site integrity. The attack requires that the site owner has enabled User Level Permissions for the Subscriber role, facilitating access to the necessary AJAX functionality to deliver the malicious payload effectively.

References