Skip to content
Noroxi

The Ultimate WordPress Toolkit – WP Extended

wpextended · plugin

Known security vulnerabilities for The Ultimate WordPress Toolkit – WP Extended. Find out in seconds which version runs on your site with WP Lens.

17 known vulnerabilities

2 with public exploit code · latest Mar 22, 2026

Vulnerabilities

  • CVE-2026-4314

    The Ultimate WordPress Toolkit – WP Extended <= 3.2.4 - Authenticated (Subscriber+) Privilege Escalation via Menu Editor Module

    High 8.8

  • CVE-2024-11816

    The Ultimate WordPress Toolkit – WP Extended <= 3.0.11 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution

    High 8.8

  • CVE-2024-8102

    The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Authenticated (Subscriber+) Arbitrary Options Update

    High 8.8

  • CVE-2024-13184

    The Ultimate WordPress Toolkit – WP Extended <= 3.0.12 - Unauthenticated SQL Injection via Login Attempts Module

    High 7.5

  • CVE-2025-30796

    WordPress The Ultimate WordPress Toolkit – WP Extended plugin <= 3.0.14 - Cross Site Scripting (XSS) vulnerability

    High 7.1

  • CVE-2024-47386

    WordPress WP Extended plugin <= 3.0.8 - Reflected Cross Site Scripting (XSS) vulnerability

    High 7.1

  • CVE-2024-8106

    The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Authenticated (Subscriber+) Sensitive Information Exposure

    Medium 6.5

  • CVE-2024-8104

    The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Directory Traversal to Authenticated (Subscriber+) Arbitrary File Download

    Medium 6.5

  • CVE-2025-4963

    WP Extended <= 3.0.15 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

    Medium 6.4

  • CVE-2024-9347

    The Ultimate WordPress Toolkit – WP Extended <= 3.0.9 - Reflected Cross-Site Scripting

    Medium 6.1

  • CVE-2024-8119

    The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Reflected Cross-Site Scripting via page

    Medium 6.1

  • CVE-2024-8117

    The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Reflected Cross-Site Scripting via selected_option

    Medium 6.1

  • CVE-2024-37259

    WordPress WP Extended plugin <= 2.4.7 - Cross Site Scripting (XSS) vulnerability

    Medium 6.1

  • CVE-2024-11916

    The Ultimate WordPress Toolkit – WP Extended <= 3.0.11 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting

    Medium 5.4

  • CVE-2024-8123

    The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Insecure Direct Object Reference

    Medium 5.4

  • CVE-2024-13554

    The Ultimate WordPress Toolkit – WP Extended <= 3.0.13 - Missing Authorization to Unauthenticated Post Order Manipulation

    Medium 5.3

  • CVE-2024-8121

    The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Missing Authorization to Admin Username Change

    Medium 4.3

← Back to directory