CVE-2026-112243 · Package
NO FIX YET · SEE WHAT TO DO
The Duplicator and Duplicator Pro WordPress plugins before 5.1.0 reflect an unsanitised parameter on an administrative page in certain configurations. An attacker who tricks a logged-in administrator into opening a crafted link can run script in that administrator's session.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Sites running the Duplicator or Duplicator Pro WordPress plugin before 5.1.0 in the configurations where the parameter is reflected on an admin page. Exploitation needs a logged-in administrator to open a crafted link, so sites that do not use these plugins can skip it. The sources do not say which configurations trigger the reflection.
Not affected if plugin-not-installed, version-5.1.0-or-later
Who cares duplicator, self-hosted, wordpress
5.1.0.5.1.0 or later.The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not sanitise and escape a parameter before reflecting it on one of its administrative pages in certain configurations, leading to Reflected Cross-Site Scripting that executes in the session of a logged-in administrator who is tricked into opening a crafted link.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.