plugin
14 known security issues reported for the Duplicate Post WordPress plugin. Most recent disclosed Mar 18, 2026.
Running Duplicate Post on your site? Check whether your installed version is affected.
Scan your site freeAuthenticated (Contributor+) Missing Authorization to Arbitrary Post Duplication and Overwrite vulnerability
The Yoast Duplicate Post plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the clone_bulk_action_handler() and republish_request() functions in all versions up to, and including, 4.5. This makes it possible for authenticated attackers, with Contributor-level ac...
The Duplicate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages...
[en] Duplicate-Post WordPress Plugin 3.2.3 contains a persistent cross-site scripting vulnerability in plugin settings parameters. Attackers can inject malicious scripts into title prefix, suffix, menu order, and blacklist fields to execute arbitrary JavaScript in admin interfaces.
The Yoast Duplicate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.2.3. This makes it possible for high-level authenticated users, such as administrators, to inject arbitrary web scripts into administrative pages via several parameters such as 'duplicate_post_...
The Yoast Duplicate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.2.3. This makes it possible for high-level authenticated users, such as administrators, to inject arbitrary web scripts into administrative pages via several parameters such as 'duplicate_post_...
[en] The duplicate-post plugin before 2.6 for WordPress has XSS.
[en] The duplicate-post plugin before 2.6 for WordPress has SQL injection.
The duplicate-post plugin before 2.6 for WordPress has SQL injection.
The Yoast Duplicate Post plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 2.6 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.
This plugin is prone to a reflected XSS in options-general.php post parameter. Update the plugin.
This plugin is prone to an SQL injection in duplicate-post-admin.php. Upgrade the plugin.
The Duplicate Post plugin was vulnerable to Authenticated Stored Cross-Site Scripting (XSS). However, the POST request had a CSRF nonce that was verified, and no user's without the unfiltered_html capability, such as Author or Subscriber, were able to access the affected Duplicate Post settings page. Therefore, th...
The Yoast Duplicate Post WordPress plugin was affected by an options-general.php post Parameter Reflected XSS security vulnerability.
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free