DU
Product
Duplicator
On CISA KEVExploited in the wild
8
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 3Medium 3Low 0
Watch
Add Duplicator to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-11738 In wildKEV | 7.5 | Apr 13 | WordPress Snap Creek Duplicator Plugin File Download Vulnerability Affected: before 1.3.28; before 3.8.7.1 |
| CVE-2018-25095 | 9.8 | Jan 8 | The Duplicator WordPress plugin before 1.3.0 does not properly escape values when its installer script replaces values in WordPress configuration files Affected: before 1.3.0 |
| CVE-2018-17207 | 9.8 | Sep 19 | An issue was discovered in Snap Creek Duplicator before 1.2.42 Affected: before 1.2.42 |
| CVE-2023-6114 | 7.5 | Dec 26 | The Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro WordPress plugin before 4.5.14.2 does not disallow listing the `backups-dup-lite/tmp` directory (or the… Affected: before 1.5.7.1; before 4.5.14.2 |
| CVE-2022-2551 | 7.5 | Aug 22 | The Duplicator WordPress plugin before 1.4.7 discloses the url of the a backup to unauthenticated visitors accessing the main installer endpoint of the plugin, if the installer… Affected: before 1.4.7 |
| CVE-2023-33309 | 6.1 | May 28 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Awesome Motive Duplicator Pro plugin <= 4.5.11 versions Affected: before 4.5.11.1 |
| CVE-2018-7543 | 6.1 | Mar 26 | Cross-site scripting (XSS) vulnerability in installer/build/view.step4.php of the SnapCreek Duplicator plugin 1.2.32 for WordPress allows remote attackers to inject arbitrary… Affected: 1.2.32 |
| CVE-2022-2552 | 5.3 | Aug 22 | The Duplicator WordPress plugin before 1.4.7 does not authenticate or authorize visitors before displaying information about the system such as server software, php version and… Affected: before 1.4.7.1 |
Showing 8