Vulnerabilities

TI-2026-78567 CVE-2026-82814

PHP object injection in Duplicator and Duplicator Pro plugins

MEDIUM 41

The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.5.17 and 4.6.10, respectively, via deserialization of untrusted database content in D…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00733 Published 2026-10-21 No fix listed CWE-502

TI-2023-28328 CVE-2023-51681 · GHSA-qq69-34qx-5j24

WordPress Duplicator Plugin <= 1.5.7 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 28

Cross-Site Request Forgery (CSRF) vulnerability in Duplicator Duplicator – WordPress Migration & Backup Plugin.This issue affects Duplicator – WordPress Migration & Backup Plugin: from n/a through 1.5.7.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.0025 Published 2024-02-28 No fix listed CWE-352

TI-2023-09496 CVE-2023-23682 · GHSA-pr39-pqj4-hffr

WordPress EZP Maintenance Mode Plugin <= 1.0.1 is vulnerable to Cross Site Scripting (XSS)

LOW 27

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Snap Creek Software EZP Maintenance Mode plugin <= 1.0.1 versions.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00461 Published 2023-05-15 No fix listed CWE-79

Vulnerabilities

Filters

PHP object injection in Duplicator and Duplicator Pro plugins

WordPress Duplicator Plugin <= 1.5.7 is vulnerable to Cross Site Request Forgery (CSRF)

WordPress EZP Maintenance Mode Plugin <= 1.0.1 is vulnerable to Cross Site Scripting (XSS)