CVE-2019-25314

Impact

Yoast Duplicate-Post WordPress Plugin 3.2.3 contains a persistent cross-site scripting vulnerability in plugin settings parameters. Attackers can inject malicious scripts into title prefix, suffix, menu order, and blacklist fields to execute arbitrary JavaScript in admin interfaces.

Affected packages

This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.

References

• NVD record
• CVE.org record
• https://duplicate-post.lopo.it/
• https://wordpress.org/plugins/duplicate-post/
• https://www.exploit-db.com/exploits/47424
• https://www.vulncheck.com/advisories/duplicate-post-persistent-cross-site-scripting
• https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/duplicate-post/yoast-duplicate-post-323-authenticated-admin-stored-cross-site-scripting