---
id: "CVE-2026-112243"
kind: "vulnerability"
aliases: ["CVE-2026-112243"]
title: "Duplicator WordPress plugin: reflected XSS on admin pages via crafted link"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["duplicator", "package", "self-hosted", "wordpress"]
not_affected_if: ["plugin-not-installed", "version-5.1.0-or-later"]
published_at: "2026-11-04T06:16:58+00:00"
first_seen_at: "2026-11-04T06:25:18+00:00"
updated_at: "2026-11-04T06:26:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112243", "first_seen_at": "2026-11-04T06:25:18+00:00"}]
---

# Duplicator WordPress plugin: reflected XSS on admin pages via crafted link

The Duplicator and Duplicator Pro WordPress plugins before 5.1.0 reflect an unsanitised parameter on an administrative page in certain configurations. An attacker who tricks a logged-in administrator into opening a crafted link can run script in that administrator's session.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Duplicator or Duplicator Pro plugin version in the WordPress admin under Plugins.
- Compare the installed version against `5.1.0`.

## Fix

- Duplicator and Duplicator Pro: move to `5.1.0` or later.

## Timeline

- 2026-11-04T06:25:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112243

## From the sources

The Duplicator  WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not sanitise and escape a parameter before reflecting it on one of its administrative pages in certain configurations, leading to Reflected Cross-Site Scripting that executes in the session of a logged-in administrator who is tricked into opening a crafted link.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_