CVE-2024-13184

CVE-2024-13184 The Ultimate WordPress Toolkit – WP Extended = 3.0.12 - Unauthenticated SQL Injection via Login Attempts Module Description The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to time-based SQL Injection via the Login Attempts module in all versions ...

CVE-2026-123481

Missing Authorization vulnerability in WP Extended The Ultimate WordPress Toolkit – WP Extended wpextended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Ultimate WordPress Toolkit – WP Extended: from n/a through 3.4.2...

CVE-2026-123481 WordPress The Ultimate WordPress Toolkit – WP Extended plugin <= 3.4.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP Extended The Ultimate WordPress Toolkit – WP Extended wpextended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Ultimate WordPress Toolkit – WP Extended: from n/a through 3.4.2...

EUVD-2026-123514

Missing Authorization vulnerability in WP Extended The Ultimate WordPress Toolkit – WP Extended wpextended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Ultimate WordPress Toolkit – WP Extended: from n/a through 3.4.2...

CVE-2026-123481

The The Ultimate WordPress Toolkit – WP Extended plugin (versions

WordPress The Ultimate WordPress Toolkit – WP Extended plugin <= 3.4.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mnzn in WordPress Plugin The Ultimate WordPress Toolkit – WP Extended versions = 3.4.2...

CVE-2026-123481: WP Extended The Ultimate WordPress Toolkit – WP Extended: Missing Authorization vulnerability in WP Extended The Ultimate WordPress Toolkit – WP Extended wpextended allows…

Missing Authorization vulnerability in WP Extended The Ultimate WordPress Toolkit – WP Extended wpextended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Ultimate WordPress Toolkit – WP Extended: from n/a through 3.4.2...

PT-2026-145188

Missing Authorization vulnerability in WP Extended The Ultimate WordPress Toolkit – WP Extended wpextended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Ultimate WordPress Toolkit – WP Extended: from n/a through 3.4.2...

CVE-2026-4314

The CVE concerns The Ultimate WordPress Toolkit – WP Extended plugin for WordPress (up to version 3.2.4). In the Menu Editor module, isDashboardOrProfileRequest() uses an insecure strpos() check against $_SERVER['REQUEST_URI'] to detect dashboard/profile requests. The grantVirtualCaps() function ...

CVE-2026-4314 The Ultimate WordPress Toolkit – WP Extended <= 3.2.4 - Authenticated (Subscriber+) Privilege Escalation via Menu Editor Module

The 'The Ultimate WordPress Toolkit – WP Extended' plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.2.4. This is due to the isDashboardOrProfileRequest method in the Menu Editor module using an insecure strpos check against $SERVER'REQUESTURI' to...

CVE-2026-4314: Improper Privilege Management

The 'The Ultimate WordPress Toolkit – WP Extended' plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.2.4. This is due to the isDashboardOrProfileRequest method in the Menu Editor module using an insecure strpos check against $SERVER'REQUESTURI' to...

EUVD-2024-36538

Malicious code in bioql PyPI...

EUVD-2024-42422

Malicious code in bioql PyPI...

CVE-2025-4963

The WP Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.0.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, t...

CVE-2025-4963 WP Extended <= 3.0.15 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

The WP Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.0.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, t...

CVE-2025-4963 WP Extended <= 3.0.15 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

The WP Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.0.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, t...

CVE-2025-4963

The CVE-2025-4963 entry describes a Stored Cross-Site Scripting (XS S) vulnerability in the WordPress WP Extended plugin. Affected software: WP Extended plugin for WordPress (versions up to and including 3.0.15). Root cause: insufficient input sanitization and output escaping for SVG file uploads...

CVE-2025-4963: Improper Neutralization of Input During Web Page Generation

The WP Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.0.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, t...

WordPress WP Extended plugin <= 3.0.15 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload vulnerability

Authenticated Author+ Stored Cross-Site Scripting via SVG File Upload vulnerability discovered by rajanhoyr in WordPress Plugin The Ultimate WordPress Toolkit – WP Extended versions = 3.0.15...

CVE-2024-9347

The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpext-export' parameter in all versions up to, and including, 3.0.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...