Duplicate Page and Post

Duplicate Page and Post has 5 disclosed vulnerabilities in the WordSec catalog, reported between 2020 and 2026; 4 are fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 6.6, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 1 high. 2022 was the busiest year with 2 disclosures.

The most common weakness is SQL Injection, behind 3 of the records (60%). Other recurring categories include Cross-Site Scripting.

4 of the records (80%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2025.

4 independent researchers contributed these findings, one record each. Duplicate Page and Post is installed on roughly 70,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium

6.6/ 10

Patch Coverage80%

Open

Fixed

Get automatic notifications for all Duplicate Page and Post vulnerabilities before they are exploited.

Most severe open issueCVSS 6.5CVE-2025-6189

Duplicate Page and Post <= 2.9.5 - Authenticated (Contributor+) SQL Injection via meta_key Parameter

Read the full analysis

Vulnerability Records

5 records


2026-05-27 00:00	Duplicate Page and Post <= 2.9.5 - Authenticated (Contributor+) SQL Injection Duplicate Page and Post <= 2.9.5	`CVE-2026-49046`	6.5 Medium	timomangcut	Yes
2025-09-09 17:40	Duplicate Page and Post <= 2.9.5 - Authenticated (Contributor+) SQL Injection via meta_key Parameter Duplicate Page and Post <= 2.9.5	`CVE-2025-6189`	6.5 Medium	ISMAILSHADOW	No
2022-07-20 00:00	Duplicate Page and Post <= 2.7 - Authenticated (Admin+) Stored Cross-Site Scripting Duplicate Page and Post <= 2.7	`CVE-2022-2152`	5.5 Medium	Sachin Kumar from eSec Forte Technologies Pvt Ltd	Yes
2022-07-20 00:00	Duplicate Page and Post <= 2.7 - Authenticated (Admin+) Stored Cross-Site Scripting Duplicate Page and Post <= 2.7	`N/A`	5.5 Medium	Anonymous	Yes
2020-04-25 00:00	Duplicate Page Plugins <= (Various Versions) - SQL Injection Duplicate Page and Post < 2.5.7	`N/A`	8.8 High	Antony Garand	Yes

Showing 1–5 of 5 reports

Latestv2.9.7

Duplicate Page and Post

Author

Arjun Thakur

4.6(29)

92/100

Last Updated

2026-09-04 (8d ago)

Active Installs

70,000+

Downloads

1,138,667

Requires WP

4.1+

Requires PHP

5.6+

Tested up to

WP 7.1

Created

2017-01-04 (10y ago)

Duplicate Page and Post provides a simple way to create a clone of pages, posts and custom post types. The duplicate can be created with the post status selected in the plugin settings. The plugin is lightweight and focused on fast, straightforward content duplication. Major features of this plugin include Create a clone of a particular page. Create a clone of a particular post. Create a clone of a particular custom post type (CPT). Option to select editor (Classic and Gutenberg). Option to add a post suffix. Option to add custom text for the duplicate link button. Option to select the status of duplicated posts. Option to select the redirect behavior after duplication. Like the plugin? If you find the plugin useful, your feedback is appreciated.

View on WordPress.org