Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · wpextended
WP Extended
17 known vulnerabilities on record. Add your version above to see which ones affect you.
Mar 22, 2026The Ultimate WordPress Toolkit – WP Extended: Privilege EscalationCVE-2026-4314 · affects up to 3.2.4 · reported by WordfenceHigh 8.8
The 'The Ultimate WordPress Toolkit – WP Extended' plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.2.4. This is due to the `isDashboardOrProfileRequest()` method in the Menu Editor module using an insecure `strpos()` check against `$_SERVER['REQUEST_URI']` to determine if a request targets the dashboard or profile page. The `grantVirtualCaps()` method, which is hooked into the `user_has_cap` filter, grants elevated capabilities including `manage_options` when this check returns true. This makes it possible for authenticated attackers, with Subscriber-level access and above, to gain administrative capabilities by appending a crafted query parameter to any admin URL, allowing them to update arbitrary WordPress options and ultimately create new Administrator accounts.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 28, 2025WP Extended: Stored Cross-Site ScriptingCVE-2025-4963 · affects up to 3.0.15 · reported by WordfenceMedium 6.4
The WP Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.0.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Apr 1, 2025The Ultimate WordPress Toolkit – WP Extended: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30796 · affects up to 3.0.14 · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Extended The Ultimate WordPress Toolkit – WP Extended wpextended allows Reflected XSS.This issue affects The Ultimate WordPress Toolkit – WP Extended: from n/a through <= 3.0.14.
Feb 11, 2025The Ultimate WordPress Toolkit – WP Extended: Unauthorized modification of dataCVE-2024-13554 · affects up to 3.0.13 · reported by WordfenceMedium 5.3
The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the reorder_route() function in all versions up to, and including, 3.0.13. This makes it possible for unauthenticated attackers to reorder posts.
Jan 18, 2025The Ultimate WordPress Toolkit – WP Extended: Time-based SQL InjectionCVE-2024-13184 · affects up to 3.0.12 · reported by WordfenceHigh 7.5
The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to time-based SQL Injection via the Login Attempts module in all versions up to, and including, 3.0.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 7, 2025The Ultimate WordPress Toolkit – WP Extended: Unauthorized modification and retrieval of dataCVE-2024-11916 · affects up to 3.0.11 · reported by WordfenceHigh 7.4
The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification and retrieval of data due to a missing capability check on several functions in all versions up to, and including, 3.0.11. This makes it possible for authenticated attackers, with subscriber-level access and above, to import and activate arbitrary code snippets along with
Jan 7, 2025Ultimate WordPress Toolkit – WP Extended: Remote Code Execution in version 3CVE-2024-11816 · fixed in 3.0.12 · reported by WordfenceHigh 8.8
The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Remote Code Execution in version 3.0.11. This is due to a missing capability check on the 'wpext_handle_snippet_update' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute code on the server providing an admin has created at least one code snippet.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 17, 2024The Ultimate WordPress Toolkit – WP Extended: Reflected Cross-Site ScriptingCVE-2024-9347 · affects up to 3.0.9 · reported by WordfenceMedium 6.1
The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpext-export' parameter in all versions up to, and including, 3.0.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Please note this fix was reverted in version 3.0.11 and later fixed again in version 3.0.13.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 5, 2024The Ultimate WordPress Toolkit – WP Extended: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47386 · affects up to 3.0.8 · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Extended The Ultimate WordPress Toolkit – WP Extended wpextended allows Reflected XSS.This issue affects The Ultimate WordPress Toolkit – WP Extended: from n/a through <= 3.0.8.
Sep 4, 2024The Ultimate WordPress Toolkit – WP Extended: Insecure Direct Object ReferenceCVE-2024-8123 · affects up to 3.0.8 · reported by WordfenceMedium 5.4
The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.0.8 via the duplicate_post function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to duplicate posts written by other authors including admins. This includes the ability to duplicate password-protected posts, which reveals their contents.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 4, 2024The Ultimate WordPress Toolkit – WP Extended: Unauthorized modification of user namesCVE-2024-8121 · affects up to 3.0.8 · reported by WordfenceMedium 5.4
The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification of user names due to a missing capability check on the wpext_change_admin_name() function in all versions up to, and including, 3.0.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change an admin's username to a username of their liking as long as the default 'admin' was used.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 4, 2024The Ultimate WordPress Toolkit – WP Extended: Reflected Cross-Site ScriptingCVE-2024-8119 · affects up to 3.0.8 · reported by WordfenceMedium 6.1
The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the page parameter in all versions up to, and including, 3.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 4, 2024The Ultimate WordPress Toolkit – WP Extended: Reflected Cross-Site ScriptingCVE-2024-8117 · affects up to 3.0.8 · reported by WordfenceMedium 6.1
The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘selected_option’ parameter in all versions up to, and including, 3.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 4, 2024The Ultimate WordPress Toolkit – WP Extended: Sensitive Information ExposureCVE-2024-8106 · affects up to 3.0.8 · reported by WordfenceMedium 6.5
The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.8 via the download_user_ajax function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive data including usernames, hashed passwords, and emails.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 4, 2024The Ultimate WordPress Toolkit – WP Extended: Directory TraversalCVE-2024-8104 · affects up to 3.0.8 · reported by WordfenceHigh 8.8
The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.0.8 via the download_file_ajax function. This makes it possible for authenticated attackers, with subscriber access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 4, 2024The Ultimate WordPress Toolkit – WP Extended: Unauthorized modification of data that can lead to privilege escalationCVE-2024-8102 · affects up to 3.0.8 · reported by WordfenceHigh 8.8
The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the module_all_toggle_ajax() function in all versions up to, and including, 3.0.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 22, 2024The Ultimate WordPress Toolkit – WP Extended: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-37259 · affects up to 2.4.7 · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Extended The Ultimate WordPress Toolkit – WP Extended wpextended.This issue affects The Ultimate WordPress Toolkit – WP Extended: from n/a through <= 2.4.7.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.