---
id: CVE-2026-112243
title: Duplicator < 5.1.0 - Reflected XSS via 'logname' Parameter
summary: >-
  The Duplicator  WordPress plugin before 5.1.0, duplicator-pro WordPress plugin
  before 5.1.0 does not sanitise and escape a parameter before reflecting it on
  one of its administrative pages in certain configurations, leading to
  Reflected …
severity: medium
cvss: 5.8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L'
cvssSource: adp
cwe:
  - CWE-79
product: Duplicator
affected:
  - Duplicator < 5.1.0
  - duplicator-pro < 5.1.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-04T14:05:24.924127Z'
published: '2026-11-04'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T14:18:21.578Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-112243'
references:
  - url: 'https://wpscan.com/vulnerability/402cdca7-e775-4895-808a-f161a7899114/'
tags:
  - cve.org
epss: 0.00164
epssPercentile: 0.05651
ingestedAt: '2026-11-05T21:36:00.367Z'
---

## Overview

The Duplicator  WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not sanitise and escape a parameter before reflecting it on one of its administrative pages in certain configurations, leading to Reflected Cross-Site Scripting that executes in the session of a logged-in administrator who is tricked into opening a crafted link.

## Affected

- `Duplicator < 5.1.0`
- `duplicator-pro < 5.1.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.