Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

11 records

Vendor: wpextended Component: Wp Extended Clear all filters
TI-2024-12595 CVE-2024-13554 · GHSA-6fmm-5c95-w3xg

Missing authorization in wpextended The Ultimate WordPress Toolkit – WP Extended

Priority LOW 30

The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the reorder_route() function in all versions up to, and includ…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00312 Published 2025-02-12 No fix listed CWE-862
TI-2024-11055 CVE-2024-11916 · GHSA-2235-g2f2-vp6c

Missing authorization in wpextended The Ultimate WordPress Toolkit – WP Extended

Priority LOW 32

The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification and retrieval of data due to a missing capability check on several functions in all versions up to, and inc…

CVSS 3.1HIGH 7.4 Network Low privileges No interaction EPSS 0.00217 Published 2025-01-08 No fix listed CWE-862
TI-2024-08671 CVE-2024-9347 · GHSA-53mg-f6w7-m2qc

The Ultimate WordPress Toolkit – WP Extended <= 3.0.9 - Reflected Cross-Site Scripting

Priority LOW 28

The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpext-export' parameter in all versions up to, and including, 3.0.9 due to insufficient input…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00494 Published 2024-10-17 No fix listed CWE-79
TI-2024-07529 CVE-2024-8121 · GHSA-9299-82cr-w458

The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Missing Authorization to Admin Username Change

Priority LOW 24

The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification of user names due to a missing capability check on the wpext_change_admin_name() function in all versions u…

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00323 Published 2024-09-04 No fix listed CWE-862
TI-2024-07530 CVE-2024-8123 · GHSA-3gj6-5jx3-784r

The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Insecure Direct Object Reference

Priority LOW 24

The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.0.8 via the duplicate_post function due to missing validatio…

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00309 Published 2024-09-04 No fix listed CWE-639
TI-2024-07513 CVE-2024-8102 · GHSA-cw97-95mg-vh8c

The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Authenticated (Subscriber+) Arbitrary Options Update

Priority MEDIUM 41

The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the module_all_toggle_aj…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00485 Published 2024-09-04 No fix listed CWE-862
TI-2024-07517 CVE-2024-8106 · GHSA-3xfv-v3m6-pcv2

The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Authenticated (Subscriber+) Sensitive Information Exposure

Priority LOW 29

The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.8 via the download_user_ajax function.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00461 Published 2024-09-04 No fix listed CWE-200
TI-2024-07527 CVE-2024-8119 · GHSA-36g3-797x-r29x

The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Reflected Cross-Site Scripting via page

Priority LOW 28

The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the page parameter in all versions up to, and including, 3.0.8 due to insufficient input sanitizat…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00425 Published 2024-09-04 No fix listed CWE-79
TI-2024-07515 CVE-2024-8104 · GHSA-7hvr-66jc-2p7f

Path traversal in wpextended The Ultimate WordPress Toolkit – WP Extended

Priority MEDIUM 42

The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.0.8 via the download_file_ajax function.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00957 Published 2024-09-04 No fix listed CWE-22
TI-2024-07525 CVE-2024-8117 · GHSA-xgw2-5rm5-vvmq

The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Reflected Cross-Site Scripting via selected_option

Priority LOW 28

The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘selected_option’ parameter in all versions up to, and including, 3.0.8 due to insufficient in…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00425 Published 2024-09-04 No fix listed CWE-79
TI-2024-24774 CVE-2024-37259 · GHSA-c4x4-cgpc-c2rw

WordPress WP Extended plugin <= 2.4.7 - Cross Site Scripting (XSS) vulnerability

Priority LOW 32

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Extended The Ultimate WordPress Toolkit – WP Extended wpextended.This issue affects The Ultimate WordPress Toolkit…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00624 Published 2024-07-22 No fix listed CWE-79