CVE-2026-118181

The Duplicate Post WordPress plugin before 1.5.8 does not perform a capability check when saving its global settings, relying only on its own role-access list, which allows users of any role an administrator has given Duplicate Post WordPress plugin before 1.5.8 access to, as low as Subscriber, t...

CVE-2026-118182

The Duplicate Post WordPress plugin before 1.5.8 does not check that a user duplicating a post is allowed to edit it, which, when the slug takeover option is enabled, allows users of a role an administrator has given Duplicate Post WordPress plugin before 1.5.8 access to, such as Contributor, to...

CVE-2026-118182

The Duplicate Post WordPress plugin before version 1.5.8 contains a vulnerability where it fails to verify if a user has permission to edit a post before duplicating it. When the slug takeover option is enabled, users with restricted roles, such as Contributor , can move any readable post off its...

CVE-2026-118183

The Duplicate Post WordPress plugin before version 1.5.8 is vulnerable to an authenticated post publishing restriction bypass . The plugin fails to verify if a user has the necessary permissions to publish a post during the duplication process. Consequently, users with restricted roles—such as Co...

WordPress Duplicate Post plugin < 1.5.8 - Authenticated Arbitrary Post Slug Takeover vulnerability

Authenticated Arbitrary Post Slug Takeover vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Duplicate Post versions 1.5.8...

EUVD-2026-125862

The Duplicate Post WordPress plugin before 1.5.8 does not check whether a user may publish posts when duplicating one, allowing users of a role an administrator has given Duplicate Post WordPress plugin before 1.5.8 access to, such as Contributors, to create published posts, including posts...

EUVD-2026-125861

The Duplicate Post WordPress plugin before 1.5.8 does not check that a user duplicating a post is allowed to edit it, which, when the slug takeover option is enabled, allows users of a role an administrator has given Duplicate Post WordPress plugin before 1.5.8 access to, such as Contributor, to...

WordPress Duplicate Post plugin < 1.5.8 - Authenticated Post Publishing Restriction Bypass vulnerability

Authenticated Post Publishing Restriction Bypass vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Duplicate Post versions 1.5.8...

CVE-2026-118182 Copy & Delete Posts < 1.5.8 - Authenticated Arbitrary Post Slug Takeover

The Duplicate Post WordPress plugin before 1.5.8 does not check that a user duplicating a post is allowed to edit it, which, when the slug takeover option is enabled, allows users of a role an administrator has given Duplicate Post WordPress plugin before 1.5.8 access to, such as Contributor, to...

CVE-2026-118181

The Duplicate Post WordPress plugin, in versions prior to 1.5.8 , is vulnerable to an access control modification. The plugin fails to perform a capability check when saving global settings, relying instead on its own role-access list. This allows users with lower privileges, as low as Subscriber...

WordPress Duplicate Post plugin < 1.5.8 - Authenticated Plugin Settings and Access Control Modification vulnerability

Authenticated Plugin Settings and Access Control Modification vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Duplicate Post versions 1.5.8...

CVE-2026-118181 Copy & Delete Posts < 1.5.8 - Authenticated Plugin Settings and Access Control Modification

The Duplicate Post WordPress plugin before 1.5.8 does not perform a capability check when saving its global settings, relying only on its own role-access list, which allows users of any role an administrator has given Duplicate Post WordPress plugin before 1.5.8 access to, as low as Subscriber, t...

EUVD-2026-125860

The Duplicate Post WordPress plugin before 1.5.8 does not perform a capability check when saving its global settings, relying only on its own role-access list, which allows users of any role an administrator has given Duplicate Post WordPress plugin before 1.5.8 access to, as low as Subscriber, t...

CVE-2021-43408

CVE-2021-43408: WordPress Plugin Duplicate Post version 1.1.9 - SQL Injection I. Overview 1. What is WordPress WordPress is an open-source CMS Content Management System software, a content management system. Instead of using HTML encoding language, WP is written in the PHP programming language...

CVE-2022-35501

CVE-2022-35501 Stored Cross-site Scripting XSS in blog-post creation functionality in Amasty Blog Pro for Magento 2 Description The post creation functionality in the Amasty Blog Pro 2.10.3 and 2.10.4 plugin for Magento 2 allows injection of JavaScript code in the title field, leading to XSS...

CVE-2026-118187

The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not verify that a user requesting to duplicate or revise a post has access to that specific post, only that they can edit posts of that type, allowing users with...

EUVD-2026-117914

The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not verify that a user requesting to duplicate or revise a post has access to that specific post, only that they can edit posts of that type, allowing users with...

WordPress Duplicate Post plugin <= 1.5.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Kuba in WordPress Plugin Duplicate Post versions = 1.5.6...

CVE-2026-89424

The Duplicate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'notitoken' parameter in all versions up to, and including, 1.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level acce...

CVE-2026-89424

The Duplicate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 1.5.6 . The root cause is insufficient input sanitization and output escaping involving the 'noti_token' parameter. An authenticated attacker with Subscriber-level access (or...