CVE-2019-25314

Yoast Duplicate-Post WordPress Plugin 3.2.3 contains a persistent cross-site scripting vulnerability in plugin settings parameters. Attackers can inject malicious scripts into title prefix, suffix, menu order, and blacklist fields to execute arbitrary JavaScript in admin interfaces.

CVSS v4.0

4.8 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

5.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

EPSS

0.21% chance of exploitation in the next 30 days, 11th percentile

Published

2026-02-11

Updated

2026-05-14

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/47424

References

• CVE Record
• NVD entry

Related

• CVE-2019-25313
• CVE-2019-25315
• CVE-2019-25312
• CVE-2019-25316
• CVE-2019-25311
• CVE-2019-25317