CVE-2017-16815

installer.php in the Snap Creek Duplicator (WordPress Site Migration & Backup) plugin before 1.2.30 for WordPress has XSS because the values "url_new" (/wp-content/plugins/duplicator/installer/build/view.step4.php) and "logging" (wp-content/plugins/duplicator/installer/build/view.step2.php) are not filtered correctly.

• CWE-79

• https://packetstormsecurity.com/files/144914/WordPress-Duplicator-Migration-1.2.28-Cross-Site-Scripting.htmlThird Party Advisory, VDB Entry
• https://snapcreek.com/duplicator/docs/changelogRelease Notes, Vendor Advisory
• https://packetstormsecurity.com/files/144914/WordPress-Duplicator-Migration-1.2.28-Cross-Site-Scripting.htmlThird Party Advisory, VDB Entry
• https://snapcreek.com/duplicator/docs/changelogRelease Notes, Vendor Advisory

Published

Nov 14, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-16807A cross-site Scripting (XSS) vulnerability in Kirby Panel be…
• CVE-2017-16808tcpdump before 4.9.3 has a heap-based buffer over-read relat…
• CVE-2017-1681IBM WebSphere Application Server (IBM Liberty for Java for B…
• CVE-2017-16810Cross-site scripting (XSS) vulnerability in the All Variable…
• CVE-2017-16813A denial-of-service issue was discovered in the Foxit Mobile…
• CVE-2017-16814A Directory Traversal issue was discovered in the Foxit Mobi…
• CVE-2017-16816The condor_schedd component in HTCondor before 8.6.8 and 8.7…
• CVE-2017-16818RADOS Gateway in Ceph 12.1.0 through 12.2.1 allows remote au…
• CVE-2017-16819A stored cross-site scripting vulnerability in the Icon Time…
• CVE-2017-1682IBM Connections 4.0, 4.5, 5.0, 5.5, and 6.0 is vulnerable to…
• CVE-2017-16820The csnmp_read_table function in snmp.c in the SNMP plugin i…
• CVE-2017-16821b3log Symphony (aka Sym) 2.2.0 has XSS in processor/AdminPro…5.4