CVE-2026-89424 is a stored cross-site scripting vulnerability in the Duplicate Post plugin for WordPress, affecting all versions up to and including 1.5.6. The vulnerability arises from insufficient sanitization and escaping of the 'noti_token' parameter, allowing authenticated attackers with subscriber-level privileges or above to inject arbitrary web scripts. Successful exploitation depends on the plugin's User Level Permissions being enabled for the Subscriber role, which provides access to the i_saw_this_noti AJAX branch necessary to deliver the malicious payload.

An attacker with subscriber-level access can inject persistent malicious scripts that execute in the context of other users visiting the affected pages. This can lead to information disclosure and limited integrity impacts. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and partial confidentiality and integrity impact without availability impact.

No official patch or fix is currently documented. Site owners should consider disabling User Level Permissions for the Subscriber role in the Duplicate Post plugin to prevent access to the vulnerable AJAX endpoint. Monitor vendor advisories for updates or patches addressing this vulnerability.