CVE-2021-24681

The Duplicate Page plugin contains a stored cross-site scripting vulnerability in its Duplicate Post Suffix settings affecting versions up to 4.4.1, stemming from inadequate sanitization of user input and improper escaping of output. Attackers with administrative privileges can inject malicious scripts that will execute when other users view affected pages, though this issue only manifests in multisite WordPress installations or environments where the unfiltered_html capability has been restricted.

Based on public CVE data (MITRE/NVD).