CVE-2026-53740: Yoast Duplicate Post XSS Vulnerability

CVE-2026-53740 Overview

CVE-2026-53740 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Yoast Duplicate Post WordPress plugin through version 4.6. The plugin inserts an unescaped post title and permalink into the Classic Editor scheduled republish notice. An attacker with permission to schedule a republish copy can craft a malicious post title that executes JavaScript when an administrator views the resulting notice in the WordPress admin interface. The flaw enables session theft, privilege abuse, and administrative action hijacking through the authenticated administrator context.

Critical Impact
Authenticated low-privileged contributors can store JavaScript that executes in an administrator's browser session, enabling account takeover of WordPress sites running Yoast Duplicate Post through 4.6.

Affected Products

Yoast Duplicate Post plugin for WordPress through version 4.6
WordPress sites using the Classic Editor with scheduled republish functionality
Administrator accounts viewing the scheduled republish notice

Discovery Timeline

2026-06-10 - CVE-2026-53740 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-53740

Vulnerability Analysis

The vulnerability is a stored XSS in the Yoast Duplicate Post plugin's scheduled republish workflow. The plugin renders the scheduled republish notice inside the Classic Editor to inform administrators that a post copy is queued for republication. When constructing this notice, the plugin concatenates the original post title and permalink into HTML output without applying output escaping.

A contributor or editor who can create a post and schedule a republish copy supplies the malicious payload through the post title field. When an administrator later opens the original or duplicated post in the Classic Editor, the notice renders with the embedded payload, executing script in the administrator's authenticated session.

User interaction is required because the payload only triggers when a privileged user visits the editor screen. The impact remains significant because WordPress administrators can install plugins, modify theme files, and create new accounts.

Root Cause

The root cause is missing output escaping when the plugin builds the scheduled republish notice. Functions such as esc_html() or esc_attr() are not applied to the post title and permalink before they are written into the notice markup. WordPress provides these escaping helpers specifically to neutralize HTML and JavaScript injected through stored content fields.

Attack Vector

The attack vector is network-based and requires an authenticated low-privileged account plus administrator interaction. An attacker with at least contributor-level access creates a post containing a crafted title with HTML or JavaScript. The attacker schedules the post for republish using the Yoast Duplicate Post feature. When an administrator opens the post in the Classic Editor, the unescaped notice executes the injected script, performing actions under the administrator's session.

The vulnerability mechanism is documented in the VulnCheck Advisory on Yoast. No verified public proof-of-concept code is referenced in the advisory data.

Detection Methods for CVE-2026-53740

Indicators of Compromise

Post titles in wp_posts containing HTML tags such as <script>, <img onerror=, or <svg onload=
Unexpected administrator actions originating from contributor or editor accounts, including plugin installs and user role changes
Scheduled republish entries in the Yoast Duplicate Post post meta with anomalous title values
New administrator users created shortly after a privileged user opened the Classic Editor

Detection Strategies

Query the WordPress database for post titles containing HTML or JavaScript syntax, focusing on posts authored by non-administrator accounts
Review HTTP access logs for /wp-admin/post.php requests followed by administrative API calls from the same session within seconds
Monitor wp_users and wp_usermeta for unexpected role escalations or account creations

Monitoring Recommendations

Enable a Web Application Firewall (WAF) rule that flags HTML in WordPress post title parameters submitted to /wp-admin/post-new.php and /wp-admin/post.php
Log administrator session activity and alert when actions occur within milliseconds of opening an editor screen, indicating script automation
Track installed plugin versions across WordPress estates and alert on instances of Yoast Duplicate Post at version 4.6 or earlier

How to Mitigate CVE-2026-53740

Immediate Actions Required

Update Yoast Duplicate Post to the latest version available from the WordPress Plugin Listing
Audit contributor, author, and editor accounts and remove accounts that are no longer required
Review scheduled republish entries and delete any with suspicious post titles before administrators open them in the editor

Patch Information

The vulnerability affects Yoast Duplicate Post through version 4.6. Administrators should install the vendor-supplied update from the official WordPress plugin repository. Refer to the VulnCheck Advisory on Yoast for the fixed version reference.

Workarounds

Disable the Yoast Duplicate Post plugin until the patched version is installed
Restrict the scheduled republish capability to trusted administrator accounts only
Switch authors to the Block Editor where the vulnerable Classic Editor notice is not rendered
Apply a WAF rule that strips HTML characters from post_title parameters submitted by non-administrator roles

bash

# Configuration example: disable the plugin via WP-CLI pending patch
wp plugin deactivate duplicate-post
wp plugin update duplicate-post
wp plugin activate duplicate-post