Yoast Duplicate Post Classic Editor XSS via Unescaped Title

Executive Summary

This vulnerability exists in Yoast Duplicate Post through version 4.6. It occurs because the plugin inserts an unescaped post title and permalink into the Classic Editor's scheduled republish notice. An attacker can exploit this by scheduling a republish copy with a specially crafted title that includes malicious script. When an administrator views the resulting notice, the script executes.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows attackers to execute arbitrary scripts in the context of an administrator's browser when they view the scheduled republish notice. This can lead to potential unauthorized actions, data theft, or compromise of administrative functions within the affected system.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify how CVE-2026-53740 affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is a stored Cross-Site Scripting (XSS) issue in the Yoast Duplicate Post plugin up to version 4.6, triggered when an attacker schedules a republish copy with a crafted post title that executes scripts in the Classic Editor's scheduled republish notice.

Detection involves checking if your WordPress installation uses the Yoast Duplicate Post plugin version 4.6 or earlier and if any scheduled republish posts contain suspicious or unusual titles that might include script tags or other malicious payloads.

There are no specific commands provided in the available resources to detect this vulnerability directly on your network or system.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include updating the Yoast Duplicate Post plugin to a version later than 4.6 where this vulnerability is fixed.

If an update is not immediately possible, avoid scheduling republish copies with untrusted or user-supplied post titles, and restrict administrative users from viewing scheduled republish notices until the issue is resolved.

Additionally, consider implementing input sanitization or filtering on post titles to prevent script injection.

Useful 0 Not Useful 0