Hello,

Plugin: Duplicator 0.5.24 https://wordpress.org/plugins/duplicator/

1. Cross-Site Scripting (XSS) 

Authenticated administrators can inject html/js code (there is no CSRF protection).

Method: GET

Url: http://localhost/wp-admin/admin.php?page=duplicator-tools&tab=logging&logname=[xss]

Vulnerable parameters: logname

Example PHP callstack:

/duplicator/views/tools/logging.php:158

Verification:

--