CVE-2026-89424: Inisev Duplicate Post

Medium severity, CVSS 6.4. EPSS: 0.2% chance of exploitation in the next 30 days.

The Duplicate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'noti_token' parameter in all versions up to, and including, 1.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires that the site owner has enabled the plugin's User Level Permissions for the Subscriber role, as this grants access to the i_saw_this_noti AJAX branch needed to deliver the payload.

Affected products

• Inisev Duplicate Post: up to and including 1.5.6

Published 2026-10-01. Last modified 2026-10-01.