Revmakx vulnerabilities
22 vulnerabilities
Known vulnerabilities in Revmakx products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 7 products.
Products
7- Backup And Staging By Wp Time Capsule8 vulnerabilities
- Infinitewp Client7 vulnerabilities
- WP Duplicate2 vulnerabilities
- Wpcal.Io – Easy Meeting Scheduler2 vulnerabilities
- Defendwp Firewall1 vulnerabilities
- WP Duplicate – Wordpress Migration Plugin1 vulnerabilities
- Wpcal.Io1 vulnerabilities
CVE-2021-25035revmakxbackup_and_staging_by_wp_time_capsule+2
EPSS score0.89%
The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.7 does not sanitise and escape the error parameter before outputting it back in an admin page, leading to a Reflected Cross-Site ScriptingCVE-2016-15004revmakxinfinitewp_client+2EPSS score1.73%
A vulnerability was found in InfiniteWP Client Plugin 1.5.1.3/1.6.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to injection. The attack can be launched remotely. Upgrading to version 1.6.1.1 is able to address this issue. It is recommended to upgrade the affected component.CVE-2025-47477revmakxbackup_and_staging_by_wp_time_capsule+1EPSS score0.28%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in revmakx Backup and Staging by WP Time Capsule wp-time-capsule allows Reflected XSS.This issue affects Backup and Staging by WP Time Capsule: from n/a through <= 1.22.23.CVE-2025-66103revmakxwpcal.io+1EPSS score0.23%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in revmakx WPCal.io wpcal allows DOM-Based XSS.This issue affects WPCal.io: from n/a through <= 0.9.5.9.CVE-2025-22280revmakxdefendwp firewall+1EPSS score0.28%
Missing Authorization vulnerability in revmakx DefendWP Firewall defend-wp-firewall allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DefendWP Firewall: from n/a through <= 1.1.0.CVE-2025-24652revmakxwp duplicate+1EPSS score0.43%
Missing Authorization vulnerability in revmakx WP Duplicate local-sync allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Duplicate: from n/a through <= 1.1.6.CVE-2020-8772revmakxinfinitewp_client+1EPSS score88.05%
The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization check in iwp_mmb_set_request in init.php. Any attacker who knows the username of an administrator can log in.CVE-2024-48020revmakxbackup_and_staging_by_wp_time_capsule+1EPSS score0.49%
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in revmakx Backup and Staging by WP Time Capsule wp-time-capsule allows SQL Injection.This issue affects Backup and Staging by WP Time Capsule: from n/a through <= 1.22.21.CVE-2024-38770revmakxbackup_and_staging_by_wp_time_capsule+1EPSS score0.53%
Improper Privilege Management vulnerability in Revmakx Backup and Staging by WP Time Capsule allows Privilege Escalation, Authentication Bypass.This issue affects Backup and Staging by WP Time Capsule: from n/a through 1.22.20.CVE-2024-10585revmakxinfinitewp_client+1EPSS score0.67%
The InfiniteWP Client plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.13.0 via the 'historyID' parameter of the ~/debug-chart/index.php file. This makes it possible for unauthenticated attackers to read .txt files outside of the intended directory.CVE-2024-49684revmakxbackup_and_staging_by_wp_time_capsule+1EPSS score0.53%
Deserialization of Untrusted Data vulnerability in revmakx Backup and Staging by WP Time Capsule wp-time-capsule allows Object Injection.This issue affects Backup and Staging by WP Time Capsule: from n/a through <= 1.22.21.CVE-2024-32795revmakxwpcal.io – easy meeting scheduler+1EPSS score0.20%
Cross-Site Request Forgery (CSRF) vulnerability in Revmakx WPCal.Io – Easy Meeting Scheduler.This issue affects WPCal.Io – Easy Meeting Scheduler: from n/a through 0.9.5.8.CVE-2024-8856revmakxbackup_and_staging_by_wp_time_capsule+1EPSS score94.14%
The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the the UploadHandler.php file and no direct file access prevention in all versions up to, and including, 1.22.21. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.CVE-2024-34816revmakxwpcal.io – easy meeting schedulerEPSS score0.23%
Cross-Site Request Forgery (CSRF) vulnerability in Revmakx WPCal.Io – Easy Meeting Scheduler.This issue affects WPCal.Io – Easy Meeting Scheduler: from n/a through 0.9.5.8.CVE-2026-74011revmakxinfinitewp_client+1EPSS score0.38%
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in revmakx InfiniteWP Client allows Blind SQL Injection.
This issue affects InfiniteWP Client: from n/a through 1.13.9.CVE-2026-1499revmakxwp duplicate – wordpress migration plugin+1EPSS score1.06%
The WP Duplicate plugin for WordPress is vulnerable to Missing Authorization leading to Arbitrary File Upload in all versions up to and including 1.1.8. This is due to a missing capability check on the `process_add_site()` AJAX action combined with path traversal in the file upload functionality. This makes it possible for authenticated (subscriber-level) attackers to set the internal `prod_key_random_id` option, which can then be used by an unauthenticated attacker to bypass authentication checks and write arbitrary files to the server via the `handle_upload_single_big_file()` function, ultimately leading to remote code execution.CVE-2026-42760revmakxbackup_and_staging_by_wp_time_capsule+1EPSS score0.52%
Authentication Bypass Using an Alternate Path or Channel vulnerability in revmakx Backup and Staging by WP Time Capsule wp-time-capsule allows Password Recovery Exploitation.This issue affects Backup and Staging by WP Time Capsule: from n/a through <= 1.22.25.CVE-2026-39755revmakxwp duplicate+1EPSS score0.45%
Subscriber Arbitrary File Upload in WP Duplicate <= 1.1.11 versions.CVE-2026-17576revmakxinfinitewp_client+1EPSS score0.27%
The InfiniteWP Client plugin for WordPress is vulnerable to SQL Injection via the get_comments action in versions up to, and including, 1.13.9. This is due to insufficient escaping on the array-key names supplied in the JSON request body before use in a SQL statement: IWP_MMB_Comment::get_comments() calls extract() on $args (which silently skips keys that are not valid PHP variable names) but a second foreach($args as $checkbox => $checkbox_val) processes every key, strips the 'iwp_get_comments_' prefix with str_replace(), wraps the remainder in single quotes, and imploded it into an IN(...) clause that is executed via $wpdb->get_results() with no prepare(). Because the request body is read from php://input and JSON-decoded, wp_magic_quotes() never touches the data, so quote characters in keys pass through unaltered. This makes it possible for authenticated attackers, with administrator-level access and above (an administrator can register their own public key via add_site using the plugin's WP-admin-generated activation_key and then issue signed get_comments requests), to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.CVE-2026-8996revmakxbackup_and_staging_by_wp_time_capsule+1EPSS score0.47%
The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.22.26 via the download_recent_decrypted_file_wptc. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract download the most recently admin-decrypted SQL database backup, which typically contains password hashes, user credentials, and other sensitive site configuration data stored in the 'recent_decrypted_file' option. Exploitation requires that an administrator has previously performed a decrypt action, causing the decrypted SQL backup file to exist in the plugin's upload directory; without this prior admin action, there is no file to serve.