Duplicator EUVD-2026-116722

Exploitation requires that the Duplicator or Duplicator Pro plugin (before 5.1.0) be present AND running in one of the unspecified 'certain configurations' in which the parameter is reflected on an administrative page (the exact parameter and page are not described in the available sources). Critically, it requires a victim who is a currently logged-in WordPress administrator to be tricked into opening an attacker-crafted link (UI:R), so it cannot be triggered silently or without social engineering. Limiting factors: the configuration dependency (AC:H, implying non-default or specific setups), the mandatory administrator interaction, and the fact that payload execution is confined to the context of whoever clicks the link. No standing authentication is needed by the attacker (PR:N), but the attack fails against administrators who do not open the malicious link.

This is a moderate-severity reflected XSS (CWE-79, CVSS 5.8) whose signals are consistent and point to LOW real-world urgency rather than an emergency. The CVSS vector AV:N/AC:H/PR:N/UI:R shows that while the attacker needs no privileges (PR:N), successful exploitation requires BOTH high attack complexity - the flaw only manifests 'in certain configurations' (AC:H) - AND user interaction, specifically tricking a logged-in administrator into opening a crafted link (UI:R). These two conditions substantially constrain practical exploitation. Supporting signals align: EPSS is 0.16% (6th percentile), indicating very low probability of exploitation in the wild; SSVC reports Exploitation: none, Automatable: no, Technical Impact: partial; and the item is NOT in CISA KEV. The partial impact matches the CVSS C:L/I:L/A:L (low across the board). The vuln.today decision label is 'this_month', not act_now/emergency. No signals conflict here - low EPSS, no known exploitation, high complexity, and partial impact all reinforce that this is a genuine but non-urgent, lower-priority issue that should be patched on a routine cycle. The S:C scope change (XSS running in the privileged admin context) is the one factor elevating it above a trivial self-XSS, so it should not be ignored where administrators are susceptible to link-based social engineering.

An attacker crafts a malicious URL targeting the affected administrative page parameter and, through phishing or social engineering, lures a currently logged-in WordPress administrator of a site running Duplicator/Duplicator Pro before 5.1.0 (in a vulnerable configuration) into clicking it. The unsanitized parameter is reflected back, executing attacker-controlled JavaScript in the administrator's authenticated session, potentially enabling actions such as creating accounts or altering settings. A public PoC reference exists (WPScan) but is not verified as working exploit code, and the high attack complexity (configuration-dependent) plus required admin interaction limit reliability.