CVE-2026-53740— Yoast Duplicate Post through 4.6 Stored Cross-Site Scripting via Scheduled Republish Notice
Quick assessment
Affected
Yoast Yoast Duplicate Post
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台具有在基于PHP和MySQL的服务器上架设个人博客网站的功能。WordPress plugin是一个应用插件。 WordPress plugin Yoast Duplicate Post 4.6及之前版本存在跨站脚本漏洞，该漏洞源于将未转义的帖子标题和永久链接插入经典编辑器计划重新发布通知中。攻击者可以计划使用特制标题重新发布副本，当管理员查看结果通知时执行脚
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Yoast | Yoast Duplicate Post | ≤ 4.6 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-53740
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Yoast Duplicate Post through 4.6 Stored Cross-Site Scripting via Scheduled Republish Notice
Source: CVE Program / CVE List V5
Vulnerability Description
Yoast Duplicate Post through 4.6 inserts an unescaped post title and permalink into the Classic Editor scheduled republish notice. Attackers can schedule a republish copy with a crafted title to execute script when an administrator views the resulting notice.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress plugin Yoast Duplicate Post 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台具有在基于PHP和MySQL的服务器上架设个人博客网站的功能。WordPress plugin是一个应用插件。 WordPress plugin Yoast Duplicate Post 4.6及之前版本存在跨站脚本漏洞，该漏洞源于将未转义的帖子标题和永久链接插入经典编辑器计划重新发布通知中。攻击者可以计划使用特制标题重新发布副本，当管理员查看结果通知时执行脚
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Yoast | Yoast Duplicate Post | 0 ~ 4.6 | - |
|
II. Public POCs for CVE-2026-53740
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-53740
请登录查看更多情报信息。
News Coverage for CVE-2026-53740 (1)
IV. Related Vulnerabilities
Same vendor: Yoast
-
CVE-2026-15425
Yoast SEO <= 28.0 - Authenticated (Author+) Stored Cross-Sit -
CVE-2026-53739
Yoast Duplicate Post through 4.6 Cross-Site Request Forgery -
CVE-2025-14481
Yoast SEO <= 26.5 - Insecure Direct Object Reference to Auth -
CVE-2026-3427
Yoast SEO <= 27.1.1 - Authenticated (Contributor+) Stored Cr -
CVE-2026-1217
Yoast Duplicate Post <= 4.5 - Authenticated (Contributor+) M
Same weakness: CWE-79
-
CVE-2026-111168
LibreDesk before 2.9.0-rc.8 Stored XSS via SVG Upload Conten -
CVE-2026-110878
Aureus ERP through 1.6.0 Stored XSS via Inventory Rule Actio -
CVE-2026-111233
Netgate pfSense CE 2.7.1 through 2.9.0 Reflected XSS via fir -
CVE-2026-111232
Netgate pfSense CE 2.3.0 through 2.9.0 Stored XSS via Separa -
CVE-2026-109131
Ansible-ui: ansible-ui: stored xss via unsafe javascript url
V. Comments for CVE-2026-53740
No comments yet