CVE-2026-112243: Duplicator < 5.1.0 - Reflected XSS via 'logname' Parameter
The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not sanitise and escape a parameter before reflecting it on one of its administrative pages in certain configurations, leading to Reflected Cross-Site Scripting that executes in the session of a logged-in administrator who is tricked into opening a crafted link.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Duplicator WordPress pluginto a version that resolves this vulnerability.Fixed in 5.1.0 - Upgrade
Upgrade
duplicator-pro WordPress pluginto a version that resolves this vulnerability.Fixed in 5.1.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using Duplicator or Duplicator Pro before version 5.1.0 may be affected in certain configurations. Exploitation targets a logged-in WordPress administrator rather than an unauthenticated visitor.
What does an attacker need to exploit it?
An attacker does not need prior privileges, but must convince a logged-in administrator to open a crafted link. The vulnerable logname parameter is reflected on an administrative page, allowing script execution in that administrator's session.
Is a default installation definitely affected?
The available information states that the issue occurs only in certain configurations. It does not establish that every default installation is vulnerable.
How can I determine whether remediation is needed?
Check whether Duplicator or Duplicator Pro is installed and whether its version is earlier than 5.1.0. The provided information does not identify the specific configuration conditions or a reliable detection method for prior exploitation.