Duplicate Post EUVD-2026-90573

Requires an authenticated account at subscriber level or above (PR:L), AND the site owner must have enabled the plugin's 'User Level Permissions' for the Subscriber role - this non-default setting is what grants access to the i_saw_this_noti AJAX branch used to deliver the payload. Without that configuration, subscriber-level users cannot reach the vulnerable endpoint, so the attack surface is closed on default installations. No user interaction is needed to inject; however, the payload only executes when a user subsequently views the injected page. Limited to Duplicate Post (copy-delete-posts) plugin versions up to and including 1.5.6; fixed in 1.5.7.

Signals are moderate and internally consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, 6.4 MEDIUM) describes a network-reachable, low-complexity stored XSS requiring only low privileges (PR:L = subscriber-level authenticated access) and no victim interaction to inject, with a scope change (S:C) reflecting that the injected script executes in the context of other users who later view the affected page. There is no EPSS score, no CISA KEV listing, and no public exploit in the provided intelligence, so exploitation status is: no public exploit identified at time of analysis. Crucially, the description adds a hard gating condition absent from the raw CVSS score: exploitation is ONLY possible if the site owner has explicitly enabled the plugin's 'User Level Permissions' for the Subscriber role, which is a non-default configuration that opens the i_saw_this_noti AJAX branch used to deliver the payload. This materially lowers real-world risk below what the 6.4 score alone implies - most installations leave this feature off, so a stock deployment is not exploitable by subscribers. Net: a genuine but configuration-dependent, low-to-moderate priority stored-XSS, not a high-urgency item. No key signals conflict; the main caveat is the configuration prerequisite, which the CVSS base score does not capture.

On a WordPress site where the admin has enabled the Duplicate Post plugin's User Level Permissions for the Subscriber role, a registered subscriber-level attacker sends a crafted request to the i_saw_this_noti AJAX action with a malicious 'noti_token' value. The unsanitized token is stored and later rendered without escaping, so arbitrary JavaScript executes in the browser of any user - including higher-privileged admins - who views the injected page. No public proof-of-concept is identified at time of analysis.