# CVE-2026-112243: Duplicator WordPress plugin reflected XSS via logname parameter

Source: https://junglewise.ai/threats/cve-2026-112243-the-duplicator-wordpress-plugin-before-5-1-0-duplicator-pro  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-112243 · Severity: info · Published 2026-11-04

Duplicator is a WordPress backup and migration plugin used by website administrators. The plugin fails to sanitize user input on an administrative page, allowing an attacker to inject malicious code that executes when a logged-in administrator visits a crafted link. This could lead to session hijacking or unauthorized administrative actions performed in the attacker's name.

Technologies: [Duplicator](https://junglewise.ai/threats/technologies/duplicator), [Duplicator Pro](https://junglewise.ai/threats/technologies/duplicator-pro). Vendors: [Duplicator](https://junglewise.ai/threats/vendors/duplicator).

## Quick answers

**Is CVE-2026-112243 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-112243 being exploited in the wild.

**How severe is CVE-2026-112243?** Informational severity, published 4 November 2026.

**Which products and versions are affected?** Duplicator before 5.1.0; Duplicator Pro before 5.1.0.

**Is there a fix for CVE-2026-112243?** Yes: fixed in 5.1.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-112243 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-112243?** Check whether you run Duplicator or Duplicator Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 5.1.0

## Technical details

Reflected XSS vulnerability in the logname parameter on an administrative page due to missing input sanitization and output escaping. Attack requires tricking a logged-in administrator into clicking a malicious link; the vulnerability executes with administrator privileges. A fix is available in version 5.1.0.

## Affected products

- Duplicator Duplicator before 5.1.0
- Duplicator Duplicator Pro before 5.1.0

## Timeline

- 2026-11-02: disclosed

## References

- [https://wpscan.com/vulnerability/402cdca7-e775-4895-808a-f161a7899114/](https://wpscan.com/vulnerability/402cdca7-e775-4895-808a-f161a7899114/)

## Related threats

- [Duplicator WordPress plugin SQL injection via charset rewrite](https://junglewise.ai/threats/cve-2026-115262-the-duplicator-wordpress-plugin-before-5-1-0-duplicator-pro)
- [Duplicator WordPress plugin privilege escalation in upgrade routine](https://junglewise.ai/threats/cve-2026-115251-the-duplicator-wordpress-plugin-before-5-0-0-does-not-restrict)
- [Duplicator and Duplicator Pro PHP Object Injection](https://junglewise.ai/threats/cve-2026-82814-the-duplicator-and-duplicator-pro-plugins-for-wordpress-are)