Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Unknown | Duplicator | unaffected |
|
||||||
| Unknown | duplicator-pro | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Wed, 04 Nov 2026 15:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
Wed, 04 Nov 2026 09:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-79 |
Wed, 04 Nov 2026 06:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not sanitise and escape a parameter before reflecting it on one of its administrative pages in certain configurations, leading to Reflected Cross-Site Scripting that executes in the session of a logged-in administrator who is tricked into opening a crafted link. | |
| Title | Duplicator < 5.1.0 - Reflected XSS via 'logname' Parameter | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: WPScan
Published:
Updated: 2026-11-04T14:18:21.578Z
Reserved: 2026-10-19T12:22:27.322Z
Link: CVE-2026-112243
Vulnrichment
Updated: 2026-11-04T14:03:09.002Z
NVD
Status : Deferred
Published: 2026-11-04T06:16:58.913
Modified: 2026-11-04T15:17:28.380
Link: CVE-2026-112243
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-11-04T10:00:14Z
-
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')