WP Extended – Modular WordPress Toolkit
WP Extended – Modular WordPress Toolkit has 17 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; all 17 are fixed as of October 2026. Their average CVSS score is 6.8, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 6 high. 2024 was the busiest year with 10 disclosures.
The most common weakness is Improper Neutralization Of Input During Web Page Generation, behind 7 of the records (41%). Other recurring categories include Missing Authorization, Authorization Bypass Through User-Controlled Key.
Every one of the 17 issues recorded for WP Extended – Modular WordPress Toolkit has a vendor fix available, so running the current release closes all known holes.
9 independent researchers contributed these findings, most of them (7) reported by Marco Wotschka. WP Extended – Modular WordPress Toolkit is installed on roughly 600 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2026-4314The Ultimate WordPress Toolkit – WP Extended <= 3.2.4 - Authenticated (Subscriber+) Privilege Escalation via Menu Editor Module
Read the full analysisVulnerability Records

WP Extended – Modular WordPress Toolkit
Author
WP Extended
Stop installing another plugin for every small WordPress job. WP Extended is a modular WordPress toolkit for the everyday jobs that usually send you searching for another plugin. Need to duplicate a page? Configure SMTP email? Upload SVG files? Manage code snippets? Switch between users? Change your WordPress login URL? Reorder content? Put a site into maintenance mode? WP Extended brings these tools — and many more — into one consistent plugin. Enable what your site needs. Leave the rest off. One toolkit. Individual modules. WP Extended is not designed around activating everything. Each capability is managed as its own module, so you choose the tools that fit your site. Enable a handful of modules on one WordPress site. Use a completely different combination on another. The same familiar toolkit sits underneath both. With WP Extended you can: Reduce reliance on small, single-purpose plugins Enable only the modules your site actually needs Manage everyday WordPress tools from one consistent interface Keep familiar workflows across the sites you build and maintain Start with useful functionality in the free plugin Add Pro functionality later where your workflow requires it Everyday WordPress jobs. One familiar toolkit. Duplicate Posts & Pages – Duplicate existing posts and pages without rebuilding the content or layout from scratch. Useful for landing pages, service pages, repeatable content structures and editorial workflows. SMTP Email – Configure WordPress email delivery through SMTP instead of adding another dedicated email plugin. Useful for site notifications, contact form delivery and transactional WordPress email. Code Snippets – Manage PHP, HTML, CSS and JavaScript snippets without editing your theme files. Keep small site customisations easier to find and maintain. SVG File Upload – Add SVG support to the WordPress media workflow for trusted logos, icons and scalable assets. User Switching – Switch between WordPress user accounts more quickly when testing permissions, troubleshooting issues or supporting users. Post Type Order – Reorder posts, pages and supported post types without writing custom code. Export Posts & Export Users – Export WordPress content and user data for reporting, migrations, audits and other workflows. Custom Login URL – Change the standard WordPress login path from the default URL. Limit Login Attempts – Restrict repeated login attempts and reduce common brute-force login activity. Maintenance Mode – Show visitors an appropriate maintenance page while work is taking place behind the scenes. Menu Editor – Rename, reorder or hide WordPress admin menu items to create a cleaner admin experience. Rollback Manager – Roll WordPress.org plugins or themes back to an earlier version when an update causes a problem. Browse every WP Extended module Built around the way you actually use WordPress. A large toolkit does not mean every feature should be active. That is why WP Extended is modular. Turn on SMTP on one site. Use Code Snippets and SVG uploads on another. Add content, admin or login tools where they make sense. Leave everything else disabled. Turn on what you need. Leave the rest off. A repeatable starting point for WordPress professionals. If you build or maintain WordPress sites regularly, the same small requirements tend to appear again and again: email delivery, content duplication, code snippets, user testing, SVG support, login controls, exports and admin customisation. Instead of finding and installing a different utility plugin every time one of those requirements appears, WP Extended gives you a familiar collection of tools you can configure around each project. That makes WP Extended particularly useful for: Freelancers building and maintaining client sites Agencies managing multiple WordPress websites Developers who want practical workflow and troubleshooting tools close at hand Site owners who want additional WordPress functionality without accumulating unnecessary standalone plugins Start free. Add more when your workflow needs it. WP Extended Free is designed to be useful on its own. Many modules are available directly through the WordPress.org plugin, while some modules include additional Pro functionality or are available with WP Extended Pro. You do not need to upgrade simply to understand how WP Extended works. Start with the tools your site needs today, and add more when your workflow requires them. Compare WP Extended Free and Pro What WP Extended is — and what it isn’t. WP Extended focuses on the small but important WordPress jobs that often end up spread across numerous utility plugins. It is not intended to replace every specialist WordPress product. For example, WP Extended is not positioned as a replacement for a complete: Security platform SEO platform Ecommerce system Backup service Page builder Performance or caching platform Those products solve larger specialist problems. WP Extended gives the everyday WordPress jobs a more consistent home. Why WP Extended? Modular by design – Enable the individual capabilities your site needs instead of activating an entire feature set. One familiar interface – Keep everyday WordPress tools together instead of remembering which standalone plugin controls which task. Less plugin sprawl – Reduce reliance on multiple small utility plugins that each solve one narrow requirement. Useful across multiple sites – Use the same familiar toolkit across different WordPress projects while configuring the modules differently for each one. Built for everyday WordPress work – WP Extended focuses on practical tasks that site owners, developers, freelancers and agencies repeatedly encounter. Extend WordPress. Not your plugin list. Every small WordPress requirement should not automatically mean installing another plugin. Install WP Extended and enable the modules your site actually needs. Website All modules Documentation Free vs Pro Changelog Support & contact
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C