CVE-2026-89424: Duplicate Post <= 1.5.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'noti_token' Parameter
The Duplicate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'notitoken' parameter in all versions up to, and including, 1.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires that the site owner has enabled the plugin's User Level Permissions for the Subscriber role, as this grants access to the isawthisnoti AJAX branch needed to deliver the payload.
Affected Software
Event History
Frequently Asked Questions
Which sites are exposed to exploitation by subscriber accounts?
Sites using Duplicate Post version 1.5.6 or earlier are exposed only if the plugin's User Level Permissions setting enables the Subscriber role. That setting gives subscribers access to the i_saw_this_noti AJAX branch used to deliver the payload.
What access does an attacker need?
An attacker must authenticate to the WordPress site with a Subscriber-level account or a higher-privileged account. No user interaction is required from the attacker, but the stored script executes when another user accesses an injected page.
How can I determine whether my site is affected?
Check whether Duplicate Post is installed at version 1.5.6 or earlier, and review its User Level Permissions configuration. A site is susceptible through the described path when the Subscriber role is enabled.