Reflected Cross-Site Scripting Vulnerability in Duplicator Plugin by Snap Creek
CVE-2026-112243
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 4 November 2026
Badges
What is CVE-2026-112243?
The Duplicator and Duplicator Pro plugins for WordPress prior to version 5.1.0 are susceptible to a reflected cross-site scripting vulnerability. This issue occurs due to the failure to properly sanitize and escape a parameter before reflecting it on certain administrative pages. An attacker can exploit this vulnerability by crafting a malicious link. If a logged-in administrator clicks on this link, the attacker's script could be executed in the administrator's session, potentially compromising sensitive data or actions within the WordPress instance.
Affected Version(s)
Duplicator 0 < 5.1.0
duplicator-pro 0 < 5.1.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.