CVE-2026-112243
UnknownSummary
The Duplicator and Duplicator Pro WordPress plugins before 5.1.0 do not sanitize and escape a parameter before reflecting it on one of their administrative pages in certain configurations, leading to Reflected Cross-Site Scripting that executes in the session of a logged-in administrator who is tricked into opening a crafted link.
Risk Assessment
Reflected XSS can allow an attacker to execute arbitrary JavaScript in the administrator's browser, potentially leading to account takeover or site configuration changes.
Recommendation
Update Duplicator and Duplicator Pro plugins to version 5.1.0 or later. Warn administrators about the risk of clicking unknown links.
Other vulnerabilities in Duplicator WordPress plugin
See all- CVE-2026-115262Unknown
The Duplicator and Duplicator Pro WordPress plugins before 5.1.0 do not restrict their database charset and collation rewrite to schema statements during a restore. A value a Subscriber stores in their own profile can break out of its string literal and inject SQL into the restore's INSERT statement when an administrator restores the backup onto a server lacking one of the source's charsets or collations.
- CVE-2026-112244Unknown
The Duplicator and Duplicator Pro WordPress plugins before 5.1.0 do not prevent direct access to some bundled PHP files, which initialize without their expected context, trigger a fatal error, and return a stack trace disclosing the server's absolute filesystem paths to unauthenticated users.
- CVE-2026-115251High
The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install plugins and exposes the routine without authentication. This allows an administrator of a multisite child site who is not a network administrator to install and run arbitrary PHP in the network-wide shared Duplicator directory.
Original NVD description (English source)
The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not sanitise and escape a parameter before reflecting it on one of its administrative pages in certain configurations, leading to Reflected Cross-Site Scripting that executes in the session of a logged-in administrator who is tricked into opening a crafted link.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS