VendorsWP Extendedwp_extendedany version
Vulnerabilities

WP Extended Wp Extended any version

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

11CVEs
CVE-2024-8104
The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Directory Traversal to Authenticated (Subscriber+) Arbitrary File Download
Published 2024-09-04 · Analyzed
8.8EPSS 0.010
CVE-2024-8102
The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Authenticated (Subscriber+) Arbitrary Options Update
Published 2024-09-04 · Analyzed
8.8EPSS 0.005
CVE-2024-11916
The Ultimate WordPress Toolkit – WP Extended <= 3.0.11 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
Published 2025-01-08 · Analyzed
7.4EPSS 0.002
CVE-2024-37259
WordPress WP Extended plugin <= 2.4.7 - Cross Site Scripting (XSS) vulnerability
Published 2024-07-22 · Modified
7.1EPSS 0.006
CVE-2024-8106
The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Authenticated (Subscriber+) Sensitive Information Exposure
Published 2024-09-04 · Analyzed
6.5EPSS 0.005
CVE-2024-9347
The Ultimate WordPress Toolkit – WP Extended <= 3.0.9 - Reflected Cross-Site Scripting
Published 2024-10-17 · Modified
6.1EPSS 0.005
CVE-2024-8117
The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Reflected Cross-Site Scripting via selected_option
Published 2024-09-04 · Analyzed
6.1EPSS 0.004
CVE-2024-8119
The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Reflected Cross-Site Scripting via page
Published 2024-09-04 · Analyzed
6.1EPSS 0.004
CVE-2024-8121
The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Missing Authorization to Admin Username Change
Published 2024-09-04 · Analyzed
5.4EPSS 0.003
CVE-2024-8123
The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Insecure Direct Object Reference
Published 2024-09-04 · Analyzed
5.4EPSS 0.003
CVE-2024-13554
The Ultimate WordPress Toolkit – WP Extended <= 3.0.13 - Missing Authorization to Unauthenticated Post Order Manipulation
Published 2025-02-12 · Analyzed
5.3EPSS 0.003