Yoast Duplicate Post EUVD-2026-36141

Exploitation requires an authenticated WordPress account with at minimum contributor or author role - specifically, a role that has been granted the 'Duplicate Post' capability within the plugin's settings (enabled for authors and editors by default). The vulnerable notice is rendered only in the Classic Editor interface, not the Block (Gutenberg) editor; sites that have fully migrated away from the Classic Editor plugin are not exposed via this vector. An administrator must passively view the affected scheduled republish notice (no deliberate click on a malicious link is needed beyond normal admin navigation). Exploitation is therefore limited by: (1) attacker needing a low-privilege WordPress account on the target site, (2) Classic Editor being active, and (3) an administrator encountering the republish notice during normal workflow. Sites with closed user registration and no untrusted author/contributor accounts face substantially reduced real-world risk.

The CVSS 4.0 score of 5.1 (Medium) appropriately captures the constrained but meaningful risk. The attack is network-accessible with low complexity (AV:N/AC:L) but requires a low-privilege authenticated account (PR:L) and passive administrator interaction (UI:P), making it a classic WordPress privilege escalation pattern. Downstream scope impact (SC:L/SI:L) reflects that the XSS fires in an admin session, enabling actions well beyond the attacker's own privilege tier. No EPSS data was provided, preventing quantified exploitation probability assessment - this gap should be noted. No KEV listing and no public POC reduce urgency, but the contributor-to-admin escalation path is well-understood by WordPress-targeting threat actors and frequently abused when similar stored XSS primitives exist. This is not a 'theoretical CVSS-inflated' finding - the real-world risk is genuine on multi-author or open-registration WordPress sites where contributor accounts are broadly available.

An attacker with a contributor or author WordPress account creates a duplicate of any existing post, setting the post title to a crafted XSS string such as a script tag injecting a cookie-stealing beacon. They schedule the duplicate for republish, leaving the payload dormant. The next time a site administrator opens the Classic Editor and the scheduled republish notice renders on screen, the injected script silently fires in the admin's browser - potentially exfiltrating the admin session cookie or triggering unauthorized plugin installations. No public POC has been identified, but the technique is a well-known pattern in WordPress stored XSS exploitation.