Duplicate Title Validator
Duplicate Title Validator has one disclosed vulnerability in the WordSec catalog, all reported in 2024; it is fixed as of September 2026. Their average CVSS score is 8.8, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 1 high.
The most common weakness is SQL Injection, behind 1 of the records (100%).
The one issue recorded for Duplicate Title Validator has a vendor fix available, so running the current release closes it.
Duplicate Title Validator is installed on roughly 200 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2024-49623Duplicate Title Validate <= 1.0 - Authenticated (Subscriber+) SQL Injection
Read the full analysisVulnerability Records

Duplicate Title Validator
Author
hasan movahed
Duplicate Title Validator is a robust WordPress plugin designed to ensure the uniqueness of post titles across all post types and taxonomies. By preventing duplicate titles, this plugin enhances both SEO and user experience. Whether you use Gutenberg or the Classic Editor, it seamlessly integrates to maintain title uniqueness. Key Features Comprehensive Duplicate Detection: Scans selected post types (including custom ones) and taxonomies to identify duplicate titles. Case-insensitive comparison catches duplicates regardless of capitalisation. Post Type Selection: Choose which post types are included in duplicate title checking from the settings page. Gutenberg Publish Lock: In the block editor, the Publish button is fully disabled when a duplicate title is detected, with a pre-publish warning panel showing the conflicting titles. Classic Editor Protection: Automatically saves posts with duplicate titles as drafts to prevent accidental publishing, with a dismissible admin notice. Forbidden Words Filter: Define a list of words or phrases that must not appear in post titles. Choose to block publishing entirely or show a warning while allowing publishing. Admin Email Notifications: Configure one or more admin email addresses to receive an alert whenever a post with a duplicate title is published. Includes 5-minute throttling to prevent spam. Duplicate Title Report: A dedicated report page lists all published posts with duplicate titles, grouped by title, with direct edit links. Real-time Similar Titles: As you type a title, a live list of similar existing titles appears below the input field in both editors. Dashboard Widget: A dedicated widget on the WordPress dashboard identifies similar or potentially duplicate titles using cosine similarity, with colour-coded scores and direct edit links. Redesigned Settings Page: A clean, card-based settings UI with toggle switches, inline field descriptions, and a test email button. Result Caching: Dashboard widget results are cached for one hour to avoid performance issues on large sites. Mobile Optimised: All admin pages and widgets are fully responsive at the 782px WordPress mobile breakpoint. Localization Support: Fully translated into 6 languages – English, Persian, Spanish, Portuguese (Brazil), German, and Arabic – with support for adding more. New in Version 1.9 Security Fix (XSS): The Gutenberg meta box no longer injects post titles into innerHTML. Results are built with DOM APIs and textContent, so malicious titles saved by other users can never execute scripts. Server-Side Enforcement: Duplicate title and forbidden word checks now also run on REST saves (Gutenberg, mobile apps, other REST clients) instead of relying only on the client-side editor lock. Blocked posts are downgraded to drafts server-side, so publishing cannot be bypassed with direct REST requests. REST Honours “Allow Duplicate Titles”: The check-duplicate endpoint now returns a blocking message when duplicates are not allowed, and a warning-only message when they are. Quick Edit Visibility: Saves blocked via Quick Edit / Bulk Edit now show an explanatory error notice on the post list screen instead of failing silently. Taxonomy Checks Respect Settings: Taxonomy duplicate checks are limited to taxonomies attached to the selected post types. Accurate Similar Titles: The similar-titles list in the editor excludes the post being edited, accepts post_id, and is capped at 50 results. Refactor: Duplicate_Title_Validate_Word_Filter methods are static, eliminating duplicate hook registration on every post screen load. New in Version 1.8 Forbidden Words Filter: Block publishing or show a warning when a post title contains configured words or phrases. Integrated into both Gutenberg and the Classic Editor. Admin Email Notifications: Notify one or more admins when a duplicate title is published. Configurable email list with a Send Test Email button. 5-minute throttling prevents notification spam. Post Type Selection: Choose which post types are checked for duplicate titles. Leave all unchecked to check all public post types. Duplicate Title Report Page: A new submenu page lists all published posts with duplicate titles, grouped by title, with post type badges and direct edit links. Case-insensitive Comparison: Duplicate detection now uses LOWER() in SQL so “Hello” and “hello” are treated as the same title. Mobile Optimisation: Settings page, report page, and dashboard widget are now fully responsive. Bug Fixes: Fixed WooCommerce notice disappearing too quickly, fixed similar titles box hiding on exact duplicate match, fixed pair_key duplication bug in dashboard widget, fixed textdomain loading timing. All Language Files Updated: All 5 translations (fa_IR, ar, de_DE, es_ES, pt_BR) updated with all new strings. Supported Languages This plugin ships with built-in translations. No extra installation required – activate the plugin and set your WordPress language. English (en_US) – Built-in Persian / فارسی (fa_IR) – Complete Spanish / Español (es_ES) – Complete Portuguese Brazil / Português (pt_BR) – Complete German / Deutsch (de_DE) – Complete Arabic / العربية (ar) – Complete Want to add your language? Translate the .pot file in the languages/ folder using Poedit and send the .po and .mo files to hasan.mova@gmail.com. Translators Persian (fa_IR): Hasan Movahed Spanish (es_ES): Hasan Movahed Portuguese Brazil (pt_BR): Hasan Movahed German (de_DE): Hasan Movahed Arabic (ar): Hasan Movahed Special Thanks A heartfelt thank you to May for her generous financial support – you believed in this project when it needed it most and kept it alive. This plugin exists because of your kindness. Thank you. Support & Donations This plugin is free and open-source, built and maintained entirely in spare time. If it saves you time or helps your site stay organised, please consider supporting its development. Every contribution, no matter how small, helps keep this project alive and growing. To send a donation or get in touch: hasan.mova@gmail.com License This plugin is licensed under the GPLv2 or later license. Contributing Contributions are welcome! Fork the repository and submit a pull request. Ensure your code adheres to WordPress coding standards. Support Forum For assistance, visit the WordPress.org support forum.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C