CVE-2019-25314

Duplicate-Post 3.2.3 - Persistent Cross-Site Scripting

Medium · published February 11, 2026

CVSS v4.0
4.8
EPSS
0%
Percentile
14.3
In the wild
Unconfirmed
What it is

Yoast Duplicate-Post WordPress Plugin 3.2.3 contains a persistent cross-site scripting vulnerability in plugin settings parameters. Attackers can inject malicious scripts into title prefix, suffix, menu order, and blacklist fields to execute arbitrary JavaScript in admin interfaces.

The record
Technical detail
CVSS v4.0
4.8 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
EPSS
0.00240 · 14.3th percentile
Published
2026-02-11T14:56Z
EPSS history
Timeline
  • 11 FEB 14:56Z
    Duplicate-Post 3.2.3 - Persistent Cross-Site Scripting
    cvelistv5