CVE-2019-25314

The Duplicate Post plugin for WordPress through version 3.2.3 contains a stored cross-site scripting vulnerability caused by inadequate sanitization of inputs and escaping of outputs. Authenticated administrators can inject malicious scripts into pages, which then execute when other users view those pages. This vulnerability is limited to multi-site WordPress installations or setups where the unfiltered_html capability has been restricted.

Based on public CVE data (MITRE/NVD).