Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Duplicator, duplicator-pro 5.1.0 Clear all filters
TI-2026-84963 CVE-2026-115262 · GHSA-8p5f-q54f-ww8c

SQL injection in Duplicator restore via charset and collation

Priority LOW 21

The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not restrict its database charset and collation rewrite to schema statements during a restore, so a value a Subscriber store…

CVSS 3.1MEDIUM 4.8 Network Low privileges User interaction EPSS 0.00184 Published 2026-11-04 Fixed in 5.1.0 CWE-89
TI-2026-84956 CVE-2026-112244 · GHSA-v2q9-hw4w-2v6m

Full path disclosure in Duplicator WordPress plugin installer files

Priority LOW 30

The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not prevent direct access to some of its bundled PHP files, which initialise without their expected context, trigger a fatal…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00251 Published 2026-11-04 Fixed in 5.1.0 CWE-209
TI-2026-84955 CVE-2026-112243 · GHSA-4347-wh28-8rhq

Reflected cross-site scripting in Duplicator WordPress plugin

Priority LOW 25

The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not sanitise and escape a parameter before reflecting it on one of its administrative pages in certain configurations, leadi…

CVSS 3.1MEDIUM 5.8 Network No auth User interaction EPSS 0.00153 Published 2026-11-04 Fixed in 5.1.0 CWE-79