Skip to content
OpenAdvisories

Product · revmakx

InfiniteWP Client

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-17576

    InfiniteWP Client <= 1.13.9 - Authenticated (Admin+) SQL Injection via 'iwp_get_comments_*' Array Key

    The InfiniteWP Client plugin for WordPress is vulnerable to SQL Injection via the get_comments action in versions up to, and including, 1.13.9. This is due to insufficient escaping on the array-key names supplied in the JSON request body before use in a SQL s…

    revmakx InfiniteWP Client Web / CMS
  • Medium 5.3
    CVE-2024-10585

    InfiniteWP Client <= 1.13.0 - Unauthenticated Limited Directory Traversal to Arbitrary .txt File Reading

    The InfiniteWP Client plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.13.0 via the 'historyID' parameter of the ~/debug-chart/index.php file. This makes it possible for unauthenticated attackers to read .txt files …

    revmakx InfiniteWP Client Web / CMS
  • Medium 5.9
    CVE-2023-6565

    InfiniteWP Client <= 1.12.3 - Unauthenticated Sensitive Information Exposure

    The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.12.3 via the multi-call backup option. This makes it possible for unauthenticated attackers to extract sensitive data from a tem…

    revmakx InfiniteWP Client Web / CMS