WordPress Duplicator Plugin <= 0.5.26 - Cross Site Scripting

This plugin is prone to a cross site scripting vulnerability via "logname" parameter. Solution Update the plugin...

Duplicator <= 0.5.26 - Authenticated Cross-Site Scripting (XSS)

The Duplicator – WordPress Migration Plugin WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS security vulnerability...

WordPress plugin Duplicator views/actions.php duplicator_delid parameter SQL injection vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL.Duplicator Plugin for WordPress is a plugin for WordPress. Duplicator Plugin for WordPress views/actions.php script handles a...

WordPress Plugin Duplicator 0.5.14 - SQL Injection / Cross-Site Request Forgery

Exploit Title : Wordpress Duplicator prefix . 'duplicatorpackages'; $postIDs = isset$post'duplicatordelid' ? $post'duplicatordelid' : null; $list = explode",", $postIDs; $delCount = 0; if $postIDs != null foreach $list as $id $getResult = $wpdb-getresults"SELECT name, hash FROM $tblName WHERE id...

WordPress Duplicator Plugin <= 0.5.14 - SQL Injection and CSRF

Duplicator plugin is prone to an SQL injection and cross-site request forgery vulnerabilities that allow an attacker to get an authenticated admin by executing arbitrary SQL queries. Solution Upgrade the plugin...

WordPress Plugin Duplicator 0.5.14 - SQL Injection Cross-Site Request Forgery

WordPress Plugin Duplicator 0.5.14 - SQL Injection Cross-Site Request Forgery Exploit Title : Wordpress Duplicator prefix . 'duplicatorpackages'; $postIDs = isset$post'duplicatordelid' ? $post'duplicatordelid' : null; $list = explode",", $postIDs; $delCount = 0; if $postIDs != null foreach $list...

WordPress Duplicator 0.5.14 Cross Site Request Forgery / SQL Injection Vulnerabilities

WordPress Duplicator plugin versions 0.5.14 and below suffer from cross site request forgery and remote SQL injection vulnerabilities. Exploit Title : Wordpress Duplicator prefix . 'duplicatorpackages'; $postIDs = isset$post'duplicatordelid' ? $post'duplicatordelid' : null; $list = explode",",...

WordPress Duplicator 0.5.14 Cross Site Request Forgery / SQL Injection

Exploit Title : Wordpress Duplicator prefix . 'duplicatorpackages'; $postIDs = isset$post'duplicatordelid' ? $post'duplicatordelid' : null; $list = explode",", $postIDs; $delCount = 0; if $postIDs != null foreach $list as $id $getResult = $wpdb-getresults"SELECT name, hash FROM $tblName WHERE id...

Duplicator <= 0.5.14 - SQL Injection & CSRF

An authorised user with "export" permission or a remote unauthenticated attacker could use this vulnerability to execute arbitrary SQL queries on the victim WordPress web site by enticing an authenticated admin CSRF. http://www.example.com/wp-admin/admin-ajax.php?action=duplicatorpackagedelete PO...

Duplicator <= 0.5.14 - SQL Injection & CSRF

An authorised user with "export" permission or a remote unauthenticated attacker could use this vulnerability to execute arbitrary SQL queries on the victim WordPress web site by enticing an authenticated admin CSRF. PoC http://www.example.com/wp-admin/admin-ajax.php?action=duplicatorpackagedelet...

Duplicator 0.5.8 - Privilege Escalation

The Duplicator – WordPress Migration Plugin WordPress plugin was affected by a Privilege Escalation security vulnerability...

WordPress Duplicator 0.5.8 Privilege Escalation Vulnerability

WordPress Duplicator plugin version 0.5.8 suffers from a backup related vulnerability that allows for privilege escalation. Exploit Title: Duplicator 0.5.8 Privilege Escalation Date: 21-11-2014 Software Link: https://wordpress.org/plugins/duplicator/ Exploit Author: Kacper Szurek Contact:...

WordPress Plugin Duplicator 0.5.8 - Privilege Escalation

WordPress Plugin Duplicator 0.5.8 - Privilege Escalation Exploit Title: Duplicator 0.5.8 Privilege Escalation Date: 21-11-2014 Software Link: https://wordpress.org/plugins/duplicator/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website: http://security.szurek.pl/...

WordPress Plugin Duplicator 0.5.8 - Privilege Escalation

Exploit Title: Duplicator 0.5.8 Privilege Escalation Date: 21-11-2014 Software Link: https://wordpress.org/plugins/duplicator/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website: http://security.szurek.pl/ Category: webapps 1. Description Every registered user can crea...

WordPress Duplicator 0.5.8 Privilege Escalation

Exploit Title: Duplicator 0.5.8 Privilege Escalation Date: 21-11-2014 Software Link: https://wordpress.org/plugins/duplicator/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website: http://security.szurek.pl/ Category: webapps 1. Description Every registered user can crea...

Duplicator - installer.cleanup.php package Parameter XSS

The Duplicator – WordPress Migration Plugin WordPress plugin was affected by an installer.cleanup.php package Parameter XSS security vulnerability...

CVE-2013-4625

Cross-site scripting XSS vulnerability in files/installer.cleanup.php in the Duplicator plugin before 0.4.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the package parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in files/installer.cleanup.php in the Duplicator plugin before 0.4.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the package parameter...

CVE-2013-4625

The CVE-2013-4625 entry concerns WordPress Duplicator Plugin (vulnerable up to 0.4.4, fixed in 0.4.5). The vulnerability is an XSS in files/installer.cleanup.php where the package parameter is insufficiently sanitized, allowing remote attackers to inject arbitrary script/HTML. Evidence from multi...

CVE-2013-4625

Cross-site scripting XSS vulnerability in files/installer.cleanup.php in the Duplicator plugin before 0.4.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the package parameter...