CVE Database /
CVE-2026-53740
CVE · Medium
CVE-2026-53740 — Yoast Duplicate Post [duplicate-post] <= 4.6 (unfixed)
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2026-53740
|
Yoast Duplicate Post [duplicate-post] <= 4.6 (unfixed) |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
5.4
|
< 4.6
|
4.6 |
2026-06-10 |
—
|
CVE-2026-53740
A vulnerability in Yoast Duplicate Post version 4.6 or earlier allows attackers to insert unescaped post titles and permalinks into the Classic Editor's scheduled republish notice. This can enable script execution when an admin views the notice, potentially leading to arbitrary code execution.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings