CVE-2026-19085: Authorization Bypass Through User-Controlled Key

The Duplicate Post WordPress plugin before 1.5.6 does not check that a user may read the content of a post before duplicating it, allowing users with a delegated role to republish another user's password-protected post as publicly readable...

PT-2026-69382

Name of the Vulnerable Software and Affected Versions Duplicate Post WordPress plugin versions prior to 1.5.5 Description Insufficient per-object authorization checks in bulk copy and delete operations allow users with assigned plugin access to permanently delete arbitrary posts on the site,...

CVE-2019-25314: Undefined Security Weakness

Yoast Duplicate-Post WordPress Plugin 3.2.3 contains a persistent cross-site scripting vulnerability in plugin settings parameters. Attackers can inject malicious scripts into title prefix, suffix, menu order, and blacklist fields to execute arbitrary JavaScript in admin interfaces...

PT-2021-23835

Name of the Vulnerable Software and Affected Versions Duplicate Post WordPress plugin version 1.1.9 and earlier Description The issue occurs due to SQL injection vulnerabilities, which happen when client-supplied data is included within an SQL query insecurely. This can be exploited to read,...