CVE-2024-8104

The CVE CVE-2024-8104 affects The Ultimate WordPress Toolkit – WP Extended plugin for WordPress (

CVE-2024-11916

The Ultimate WordPress Toolkit – WP Extended plugin for WordPress (WP Extended

CVE-2024-13554

CVE-2024-13554 affects The Ultimate WordPress Toolkit – WP Extended

CVE-2024-8102

The CVE-2024-8102 entry concerns The Ultimate WordPress Toolkit – WP Extended plugin for WordPress, affected up to version 3.0.8. The root cause is a missing capability check in the module_all_toggle_ajax() function, enabling authenticated attackers with Subscriber-level access or higher to perfo...

CVE-2024-8121

CVE-2024-8121 affects The Ultimate WordPress Toolkit – WP Extended plugin (versions

CVE-2024-37259

The WP Extended (The Ultimate WordPress Toolkit) plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 2.4.7 . The root cause is insufficient input sanitization and output escaping , which allows unauthenticated attackers to inject arbitrary web s...

CVE-2024-8106

CVE-2024-8106 : The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to a Sensitive Information Exposure flaw via the download_user_ajax function in all versions up to and including 3.0.8. Authenticated attackers with Subscriber+ access can exfiltrate sensitive data suc...

CVE-2024-8123

CVE-2024-8123 affects the WordPress plugin “The Ultimate WordPress Toolkit – WP Extended” (

CVE-2024-9347

CVE-2024-9347 affects the WordPress plugin “The Ultimate WordPress Toolkit – WP Extended” (WP Extended) for WordPress. The vulnerability is a reflected Cross-Site Scripting (XSS) in the wpext-export parameter across all versions up to and including 3.0.9, caused by insufficient input sanitization...

CVE-2024-8119

CVE-2024-8119 affects the WordPress plugin The Ultimate WordPress Toolkit – WP Extended (versions

CVE-2024-8117

CVE-2024-8117 refers to the The Ultimate WordPress Toolkit – WP Extended plugin for WordPress. The vulnerability is a Reflected Cross‑Site Scripting via the ‘selected_option’ parameter in versions up to and including 3.0.8, caused by insufficient input sanitization and output escaping. An unauthe...