Advisories · Technology

duplicator-pro.

Every CVE that names duplicator-pro among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-115262 CVE record

CVSS 4.8 Medium

Duplicator < 5.1.0 - Subscriber+ SQLi via Charset and Collation Rewriter During Restore
- Duplicator
- duplicator-pro
- SQL injection
Not analysed yet 4 Nov 2026
CVE-2026-112244 CVE record

CVSS 5.3 Medium

Duplicator 5.0.0 - 5.0.6 - Unauthenticated Full Path Disclosure via Installer Entry Points
- Duplicator
- duplicator-pro
- Information disclosure
Not analysed yet 4 Nov 2026
CVE-2026-112243 CVE record

CVSS 5.8 Medium

Duplicator < 5.1.0 - Reflected XSS via 'logname' Parameter
- Duplicator
- duplicator-pro
- Cross-site scripting (XSS)
Not analysed yet 4 Nov 2026
CVE-2026-82814 CVE record

CVSS 8.8 High

Duplicator <= 1.5.17 and Duplicator Pro <= 4.6.10 - Unauthenticated PHP Object Injection
- smub Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More
- Duplicator Pro
- Insecure deserialization
Not analysed yet 21 Oct 2026
CVE-2023-6114 CVE record

Duplicator < 1.5.7.1; Duplicator Pro < 4.5.14.2 - Unauthenticated Sensitive Data Exposure
- Duplicator
- Duplicator Pro
Not analysed yet 26 Dec 2023