{"affected":[{"defaultStatus":"unaffected","product":"Duplicator","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"5.1.0","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"duplicator-pro","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"5.1.0","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-112243","cwes":["CWE-79"],"description":"The Duplicator  WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not sanitise and escape a parameter before reflecting it on one of its administrative pages in certain configurations, leading to Reflected Cross-Site Scripting that executes in the session of a logged-in administrator who is tricked into opening a crafted link.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/402cdca7-e775-4895-808a-f161a7899114/"}],"kev":null,"metrics":[],"modifiedAt":1793772025913,"publishedAt":1793772025913,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/402cdca7-e775-4895-808a-f161a7899114/"}],"remediation":[],"revision":"2feebe7742a7599d0c8baf9b53c8bc2dda642069d2be67cbbc993594a729dd25","sources":[{"modifiedAt":1793772025913,"name":"CNA: WPScan","retrievedAt":1793776126875,"url":"https://www.cve.org/CVERecord?id=CVE-2026-112243"}],"ssvc":null,"status":"published","title":"Duplicator < 5.1.0 - Reflected XSS via 'logname' Parameter","updatedAt":1793776126875}