{"id":"CVE-2026-112243","kind":"vulnerability","aliases":["CVE-2026-112243"],"related":[],"title":"Duplicator WordPress plugin: reflected XSS on admin pages via crafted link","description":"The Duplicator  WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not sanitise and escape a parameter before reflecting it on one of its administrative pages in certain configurations, leading to Reflected Cross-Site Scripting that executes in the session of a logged-in administrator who is tricked into opening a crafted link.","summary":"The Duplicator and Duplicator Pro WordPress plugins before 5.1.0 reflect an unsanitised parameter on an administrative page in certain configurations. An attacker who tricks a logged-in administrator into opening a crafted link can run script in that administrator's session.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["duplicator","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed","version-5.1.0-or-later"],"how_to_check":"- Check the installed Duplicator or Duplicator Pro plugin version in the WordPress admin under Plugins.\n- Compare the installed version against `5.1.0`.","fix":"- Duplicator and Duplicator Pro: move to `5.1.0` or later.","status":"open","published_at":"2026-11-04T06:16:58+00:00","first_seen_at":"2026-11-04T06:25:18+00:00","triaged_at":"2026-11-04T06:26:23+00:00","updated_at":"2026-11-04T06:26:23+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-04T06:26:23Z","model":"claude-haiku-5-5","output":{"fix":"- Duplicator and Duplicator Pro: move to `5.1.0` or later.","reach":"internet","title":"Duplicator WordPress plugin: reflected XSS on admin pages via crafted link","impact":"medium","summary":"The Duplicator and Duplicator Pro WordPress plugins before 5.1.0 reflect an unsanitised parameter on an administrative page in certain configurations. An attacker who tricks a logged-in administrator into opening a crafted link can run script in that administrator's session.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","duplicator","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"script runs in an administrator's WordPress session","analyst_note":"","how_to_check":"- Check the installed Duplicator or Duplicator Pro plugin version in the WordPress admin under Plugins.\n- Compare the installed version against `5.1.0`.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","version-5.1.0-or-later"],"who_is_affected":"Sites running the Duplicator or Duplicator Pro WordPress plugin before 5.1.0 in the configurations where the parameter is reflected on an admin page. Exploitation needs a logged-in administrator to open a crafted link, so sites that do not use these plugins can skip it. The sources do not say which configurations trigger the reflection.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.00069,"input_tokens":4156,"output_tokens":549,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-112243':14A,17A '-2026':13A,16A '5.1.0':32B,71C,78C 'admin':7A 'administr':39B,52B,63B,93C,115C 'attack':45B 'certain':42B,96C 'configur':43B,97C 'craft':10A,56B,122C 'cross':102C 'cross-sit':101C 'cve':12A,15A 'duplic':1A,18B,25B,27B,67C,73C 'duplicator-pro':72C 'escap':83C 'execut':106C 'host':22B 'lead':98C 'link':11A,57B,123C 'log':50B,113C 'logged-in':49B,112C 'one':90C 'open':54B,120C 'packag':19B 'page':8A,40B,94C 'paramet':36B,85C 'plugin':3A,30B,69C,76C 'pro':28B,74C 'reflect':4A,33B,87C,100C 'run':59B 'sanitis':81C 'script':60B,104C 'self':21B 'self-host':20B 'session':65B,109C 'site':103C 'trick':47B,118C 'unsanitis':35B 'via':9A 'wordpress':2A,23B,29B,68C,75C 'xss':5A","nicknames":[],"mitigations":[],"who_affected":"Sites running the Duplicator or Duplicator Pro WordPress plugin before 5.1.0 in the configurations where the parameter is reflected on an admin page. Exploitation needs a logged-in administrator to open a crafted link, so sites that do not use these plugins can skip it. The sources do not say which configurations trigger the reflection.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["duplicator","medium","package","selfhosted","wordpress"],"campaign_type":null,"first_public_at":"2026-11-04T06:16:58+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112243","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112243","severity":null,"published_at":"2026-11-04T06:16:58+00:00","modified_at":"2026-11-04T06:16:58+00:00","first_seen_at":"2026-11-04T06:25:18+00:00","fetched_at":"2026-11-04T06:25:18+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}