WordPress duplicator-pro plugin < 5.1.0 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Duplicator Pro versions 5.1.0...

WordPress Duplicator plugin < 5.1.0 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Duplicator versions 5.1.0...

EUVD-2026-116730

The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not restrict its database charset and collation rewrite to schema statements during a restore, so a value a Subscriber stores in their own profile can break out of its string literal and inject SQL int...

EUVD-2026-116723

The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not prevent direct access to some of its bundled PHP files, which initialise without their expected context, trigger a fatal error, and return a stack trace that discloses the server's absolute...

EUVD-2026-116722

The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not sanitise and escape a parameter before reflecting it on one of its administrative pages in certain configurations, leading to Reflected Cross-Site Scripting that executes in the session of a...

EUVD-2026-116720

The Post Duplicator WordPress plugin before 3.0.17 does not check whether the requesting user may view each post before returning a list of posts for a post type, allowing users with a role as low as Contributor to read the titles and hierarchy of other users' draft and private posts...

CVE-2026-112243

The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not sanitise and escape a parameter before reflecting it on one of its administrative pages in certain configurations, leading to Reflected Cross-Site Scripting that executes in the session of a...

CVE-2026-115262

The Duplicator and duplicator-pro WordPress plugins (versions before 5.1.0 ) are vulnerable to SQL injection . The flaw occurs because the plugins do not restrict database charset and collation rewrites during a restore process. A Subscriber can provide a profile value that breaks out of its stri...

CVE-2026-112244

The Duplicator and duplicator-pro WordPress plugins, in versions prior to 5.1.0 , are vulnerable to unauthenticated full path disclosure . The root cause is that the plugins do not prevent direct access to certain bundled PHP files. When these files are accessed outside their expected context, th...

CVE-2026-111740

The Post Duplicator WordPress plugin, in versions prior to 3.0.17 , is vulnerable to a permission check flaw. The plugin fails to verify if a requesting user has authorization to view specific posts before returning a list for a post type. This allows users with roles as low as Contributor to acc...

CVE-2026-112243 Duplicator < 5.1.0 - Reflected XSS via 'logname' Parameter

The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not sanitise and escape a parameter before reflecting it on one of its administrative pages in certain configurations, leading to Reflected Cross-Site Scripting that executes in the session of a...

CVE-2026-112243

The Duplicator and duplicator-pro WordPress plugins, in versions before 5.1.0 , are vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the failure to sanitize and escape a parameter before reflecting it on certain administrative pages. An attacker can trick a logged-in adminis...

Duplicator < 1.4.7.1 - Information Disclosure

The Duplicator WordPress plugin before 1.4.7 does not authenticate or authorize visitors before displaying information about the system such as server software, php version and full file system path to the site. id: CVE-2022-2552 info: name: Duplicator 1.4.7.1 - Information Disclosure author:...

WordPress Duplicator Plugin < 1.2.42 - Arbitrary Code Execution

An issue was discovered in Snap Creek Duplicator before 1.2.42. By accessing leftover installer files installer.php and installer-backup.php, an attacker can inject PHP code into wp-config.php during the database setup step, achieving arbitrary code execution. id: CVE-2018-17207 info: name:...

Duplicator < 1.5.7.1; Duplicator Pro < 4.5.14.2 - Unauthenticated Sensitive Data Exposure

The Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro WordPress plugin before 4.5.14.2 does not disallow listing the backups-dup-lite/tmp directory or the backups-dup-pro/tmp directory in the Pro version, which temporarily stores files containing sensitive data. When directory listing is...

wordpress-snapcreek

wordpress-snapcreek snapcreekduplicator file read vulnerability https://www.cvedetails.com/cve/CVE-2020-11738/ Step1: Open MSFconsole: and use wordpressscanner to find all plugins used by target machine. STEP2: Attack using python script: Install/ upgrade pip3 on attacker machine Sudo apt install...

INE-Host-and-Network-Penetration-Testing-Exploitation-CTFf-1

Host & Network Penetration Testing: Exploitation CTF 1 Ove...

CVE-2026-115251

The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install Duplicator WordPress plugin before 5.0.0, and additionally exposes the routine without authentication, allowing an administrator of a multisite child site who is not a network...

EUVD-2026-109353

The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install Duplicator WordPress plugin before 5.0.0, and additionally exposes the routine without authentication, allowing an administrator of a multisite child site who is not a network...

WordPress Duplicator plugin < 5.0.0 - Multisite Subsite Admin+ Network-Wide PHP Code Execution vulnerability

Multisite Subsite Admin+ Network-Wide PHP Code Execution vulnerability discovered by Charles Vosburgh in WordPress Plugin Duplicator versions 5.0.0...