Yoast Duplicate Post versions through 4.6 contain a cross-site scripting vulnerability due to improper neutralization of input during web page generation. Specifically, the plugin inserts unescaped post titles and permalinks into the Classic Editor's scheduled republish notice. This allows an attacker with the ability to schedule republish copies to craft a malicious post title that executes arbitrary script code in the context of an administrator viewing the notice. The vulnerability is rated medium severity with a CVSS 4.0 base score of 5.1. No vendor advisory or patch information is provided, and the vulnerability is not known to be exploited in the wild.

Successful exploitation allows an attacker with limited privileges (permission to schedule republish copies) to execute arbitrary JavaScript in the administrator's browser when viewing the scheduled republish notice. This could lead to session hijacking, privilege escalation, or other attacks within the admin context. However, exploitation requires user interaction (administrator viewing the notice) and some level of privilege to schedule republish copies.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should be cautious when viewing scheduled republish notices and consider restricting scheduling permissions to trusted users only. Monitoring for updates from Yoast regarding this vulnerability is recommended.