What’s Vulnerable › Products
wpextended The Ultimate WordPress Toolkit – WP Extended vulnerabilities
16 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.
Check whether your wpextended The Ultimate WordPress Toolkit – WP Extended version is affected
Latest wpextended The Ultimate WordPress Toolkit – WP Extended vulnerabilities
- CVE-2026-4314 — The Ultimate WordPress Toolkit – WP Extended <= 3.2.4 - Authenticated (Subscriber+) Privilege Escalation via Menu Editor Module (CVSS 8.8)
- CVE-2025-4963 — WP Extended <= 3.0.15 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4)
- CVE-2025-30796 — WordPress The Ultimate WordPress Toolkit – WP Extended plugin <= 3.0.14 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- CVE-2024-13554 — The Ultimate WordPress Toolkit – WP Extended <= 3.0.13 - Missing Authorization to Unauthenticated Post Order Manipulation (CVSS 5.3)
- CVE-2024-13184 — The Ultimate WordPress Toolkit – WP Extended <= 3.0.12 - Unauthenticated SQL Injection via Login Attempts Module (CVSS 7.5)
- CVE-2024-11916 — The Ultimate WordPress Toolkit – WP Extended <= 3.0.11 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 5.4)
- CVE-2024-9347 — The Ultimate WordPress Toolkit – WP Extended <= 3.0.9 - Reflected Cross-Site Scripting (CVSS 6.1)
- CVE-2024-47386 — WordPress WP Extended plugin <= 3.0.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- CVE-2024-8123 — The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Insecure Direct Object Reference (CVSS 5.4)
- CVE-2024-8121 — The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Missing Authorization to Admin Username Change (CVSS 4.3)
- CVE-2024-8119 — The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Reflected Cross-Site Scripting via page (CVSS 6.1)
- CVE-2024-8117 — The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Reflected Cross-Site Scripting via selected_option (CVSS 6.1)
- CVE-2024-8106 — The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Authenticated (Subscriber+) Sensitive Information Exposure (CVSS 6.5)
- CVE-2024-8104 — The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Directory Traversal to Authenticated (Subscriber+) Arbitrary File Download (CVSS 6.5)
- CVE-2024-8102 — The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Authenticated (Subscriber+) Arbitrary Options Update (CVSS 8.8)
- CVE-2024-37259 — WordPress WP Extended plugin <= 2.4.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.1)