Wpextended develops WordPress extensions and toolkits that extend the functionality of WordPress installations, with its vulnerability exposure concentrated in products such as WP Extended and Ultimate WordPress Toolkit. The recurring weakness classes—cross-site scripting, authorization bypass, path traversal, and information exposure—are characteristic of WordPress plugin development and reflect the challenges of secure input handling and access control in extensible web applications. A moderate tendency toward public exploit availability underscores the need for timely patch deployment; current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Wpextended over time
Signals from CVEs in this vendor scope (12 CVEs).
12 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2024-37259MEDIUM Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Extended The Ultimate WordPress Toolkit – WP Extended wpextended.This issue | Jul 22, 2024 | 6.1 | 27 | NO | YES |
CVE-2024-8102HIGH The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capa | Sep 4, 2024 | 8.8 | 26 | NO | NO |
CVE-2024-11816HIGH The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Remote Code Execution in version 3.0.11. This is due to a missing capability check on the 'wpext_ | Jan 8, 2025 | 8.8 | 25 | NO | NO |
CVE-2024-8104MEDIUM The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.0.8 via the download_file_ajax fu | Sep 4, 2024 | 6.5 | 21 | NO | NO |
CVE-2024-9347MEDIUM The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpext-export' parameter in all versions up to, and in | Oct 17, 2024 | 6.1 | 18 | NO | NO |
CVE-2024-8123MEDIUM The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.0.8 via the duplicat | Sep 4, 2024 | 5.4 | 18 | NO | NO |
CVE-2024-8119MEDIUM The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the page parameter in all versions up to, and including, 3 | Sep 4, 2024 | 6.1 | 18 | NO | NO |
CVE-2024-8117MEDIUM The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘selected_option’ parameter in all versions up to, and | Sep 4, 2024 | 6.1 | 18 | NO | NO |
CVE-2024-8106MEDIUM The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.8 via the download_u | Sep 4, 2024 | 6.5 | 18 | NO | NO |
CVE-2024-8121MEDIUM The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification of user names due to a missing capability check on the wpext_change | Sep 4, 2024 | 4.3 | 17 | NO | NO |
Signals from CVEs in this vendor scope (12 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Wpextended.
Media articles that mention a CVE ID that affects a product developed by Wpextended — matched by CVE ID, not by vendor name.