CVE-2019-25314

Yoast Duplicate-Post WordPress Plugin 3.2.3 contains a persistent cross-site scripting vulnerability in plugin settings parameters. Attackers can inject malicious scripts into title prefix, suffix, menu order, and blacklist fields to execute arbitrary JavaScript in admin interfaces.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://duplicate-post.lopo.it/
https://wordpress.org/plugins/duplicate-post/
https://www.exploit-db.com/exploits/47424
https://www.vulncheck.com/advisories/duplicate-post-persistent-cross-site-scripting
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/duplicate-post/yoast-duplicate-post-323-authenticated-admin-stored-cross-site-scripting

Configurations

No configuration.

History

No history.

Information

Published : 2026-02-11 15:16

Updated : 2026-06-17 02:32

NVD link : CVE-2019-25314

Mitre link : CVE-2019-25314

CVE.ORG link : CVE-2019-25314

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2019-25314", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2019-25314", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-11T15:59:47.842143Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.8, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "Yoast", "product": "Duplicate-Post", "versions": [{"status": "affected", "changes": [{"at": "3.2.4", "status": "unaffected"}], "version": "0.3", "versionType": "custom", "lessThanOrEqual": "3.2.3"}], "defaultStatus": "unaffected"}]}], "published": "2026-02-11T15:16:10.263", "references": [{"url": "https://duplicate-post.lopo.it/", "source": "disclosure@vulncheck.com"}, {"url": "https://wordpress.org/plugins/duplicate-post/", "source": "disclosure@vulncheck.com"}, {"url": "https://www.exploit-db.com/exploits/47424", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/duplicate-post-persistent-cross-site-scripting", "source": "disclosure@vulncheck.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/duplicate-post/yoast-duplicate-post-323-authenticated-admin-stored-cross-site-scripting", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "descriptions": [{"lang": "en", "value": "Yoast Duplicate-Post WordPress Plugin 3.2.3 contains a persistent cross-site scripting vulnerability in plugin settings parameters. Attackers can inject malicious scripts into title prefix, suffix, menu order, and blacklist fields to execute arbitrary JavaScript in admin interfaces."}, {"lang": "es", "value": "El plugin de WordPress Yoast Duplicate-Post 3.2.3 contiene una vulnerabilidad persistente de cross-site scripting en los par\u00e1metros de configuraci\u00f3n del plugin. Los atacantes pueden inyectar scripts maliciosos en los campos de prefijo de t\u00edtulo, sufijo, orden de men\u00fa y lista negra para ejecutar JavaScript arbitrario en las interfaces de administraci\u00f3n."}], "lastModified": "2026-06-17T02:32:03.000", "sourceIdentifier": "disclosure@vulncheck.com"}