The vulnerability is a stored cross‑site scripting flaw in Yoast Duplicate Post plugin through version 4.6. An attacker can create a scheduled republish job with a specially crafted post title. When an administrator views the editor’s republish notice, the title is inserted into the page without escaping, allowing arbitrary JavaScript to run in the admin browser context. This can lead to theft of administrative cookies, session hijacking, malicious script injection, or defacement. The weakness is a classic example of CWE‑79.

WordPress sites running Yoast Duplicate Post plugin version 4.6 or earlier are affected. The plugin is available under the Duplicate Post Project and used by any WordPress installation that has scheduled republish enabled. Users relying on the Classic Editor in WordPress will be exposed if they have scheduled republish notices.

The CVSS score of 5.1 labels the issue as moderate severity. Because the vulnerability requires the ability to schedule a republish—which is limited to users with administrative or privileged capabilities—the attack surface is restricted to site administrators. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting an absence of known widespread exploitation. Nevertheless, the potential for XSS in the admin interface justifies timely remediation.