duplicator-pro vulnerabilities
CVEs whose affected-version data names the duplicator-pro package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-112244Medium· 5.3Duplicator 5.0.0 - 5.0.6 - Unauthenticated Full Path Disclosure via Installer Entry Points
The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not prevent direct access to some of its bundled PHP files, which initialise without their expected context, trigger a fatal error, and retu…
CVE-2026-112243Medium· 5.8Duplicator < 5.1.0 - Reflected XSS via 'logname' Parameter
The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not sanitise and escape a parameter before reflecting it on one of its administrative pages in certain configurations, leading to Reflected …
CVE-2026-115262Medium· 4.8Duplicator < 5.1.0 - Subscriber+ SQLi via Charset and Collation Rewriter During Restore
The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not restrict its database charset and collation rewrite to schema statements during a restore, so a value a Subscriber stores in their own p…