Is CVE-2026-53740 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-53740 being exploited in the wild.

How severe is CVE-2026-53740?

Medium severity, with a CVSS score of 5.4, published 10 June 2026.

Is there a fix for CVE-2026-53740?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-53740 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-53740?

Check whether you run Yoast Duplicate Post at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-53740: Yoast Duplicate Post stored XSS in Classic Editor republish notice

CVE-2026-53740 · Severity: medium · CVSS 5.4 · Published 2026-06-10

Yoast Duplicate Post is a popular WordPress plugin used to clone and manage website content. A security flaw allows an attacker with basic posting privileges to insert malicious scripts into the titles of scheduled posts. When a site administrator later views the republishing notice in the Classic Editor, the script executes, potentially allowing the attacker to perform unauthorized actions or compromise the administrator's session.

Technologies: Yoast Duplicate Post. Vendors: Yoast.

Quick answers

Is CVE-2026-53740 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-53740 being exploited in the wild.
How severe is CVE-2026-53740?: Medium severity, with a CVSS score of 5.4, published 10 June 2026.
Which products and versions are affected?: Yoast Duplicate Post <= 4.6.
Is there a fix for CVE-2026-53740?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-53740 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-53740?: Check whether you run Yoast Duplicate Post at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in Yoast Duplicate Post through version 4.6. The root cause is the failure to escape the post title and permalink when generating the scheduled republish notice within the WordPress Classic Editor interface. An attacker with at least contributor-level permissions (PR:L) can create a 'Rewrite & Republish' copy of a post with a malicious payload in the title. When an administrator or editor views the resulting notice, the script executes in their browser context. This can lead to session hijacking or unauthorized administrative actions. While version 4.6 included some security enhancements for republishing, the specific XSS in the Classic Editor notice was reported as persisting through that version.

Affected products

Yoast Yoast Duplicate Post <= 4.6

Timeline

2026-06-10: advisory: Advisory published by VulnCheck and NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.