Executive Summary

This vulnerability exists in Yoast Duplicate Post through version 4.6. It occurs because the plugin inserts an unescaped post title and permalink into the Classic Editor's scheduled republish notice. An attacker can exploit this by scheduling a republish copy with a specially crafted title that includes malicious script. When an administrator views the resulting notice, the script executes.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows attackers to execute arbitrary scripts in the context of an administrator's browser when they view the scheduled republish notice. This can lead to potential unauthorized actions, data theft, or compromise of administrative functions within the affected system.

Useful 0 Not Useful 0