WP Extended – Modular WordPress Toolkit

WP Extended – Modular WordPress Toolkit has 17 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; all 17 are fixed as of October 2026. Their average CVSS score is 6.8, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 6 high. 2024 was the busiest year with 10 disclosures.

The most common weakness is Improper Neutralization Of Input During Web Page Generation, behind 7 of the records (41%). Other recurring categories include Missing Authorization, Authorization Bypass Through User-Controlled Key.

Every one of the 17 issues recorded for WP Extended – Modular WordPress Toolkit has a vendor fix available, so running the current release closes all known holes.

9 independent researchers contributed these findings, most of them (7) reported by Marco Wotschka. WP Extended – Modular WordPress Toolkit is installed on roughly 600 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

01234567891026.09.2022Today27.06.20246.1The Ultimate WordPress Toolkit – WP Extended <= 2.4.7 - Unauthenticated Stored Cross-Site Scripting CVSS 6.1 · 27.06.202403.09.20245.4The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Missing Authorization to Admin Username Change CVSS 5.4 · 03.09.20246.1The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Reflected Cross-Site Scripting via selected_option CVSS 6.1 · 03.09.20245.4The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Insecure Direct Object Reference CVSS 5.4 · 03.09.20248.8The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Authenticated (Subscriber+) Arbitrary Options Update CVSS 8.8 · 03.09.20246.5The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Authenticated (Subscriber+) Sensitive Information Exposure CVSS 6.5 · 03.09.20246.1The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Reflected Cross-Site Scripting via page CVSS 6.1 · 03.09.20248.8The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Directory Traversal to Authenticated (Subscriber+) Arbitrary File Download CVSS 8.8 · 03.09.202430.09.20246.1The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Reflected Cross-Site Scripting CVSS 6.1 · 30.09.202416.10.20246.1The Ultimate WordPress Toolkit – WP Extended <= 3.0.9 - Reflected Cross-Site Scripting CVSS 6.1 · 16.10.202407.01.20257.4The Ultimate WordPress Toolkit – WP Extended <= 3.0.11 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting CVSS 7.4 · 07.01.20258.8The Ultimate WordPress Toolkit – WP Extended <= 3.0.11 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution CVSS 8.8 · 07.01.202517.01.20257.5The Ultimate WordPress Toolkit – WP Extended <= 3.0.12 - Unauthenticated SQL Injection via Login Attempts Module CVSS 7.5 · 17.01.202511.02.20255.3The Ultimate WordPress Toolkit – WP Extended <= 3.0.13 - Missing Authorization to Unauthenticated Post Order Manipulation CVSS 5.3 · 11.02.202527.03.20256.1The Ultimate WordPress Toolkit – WP Extended <= 3.0.14 - Reflected Cross-Site Scripting CVSS 6.1 · 27.03.202527.05.20256.4WP Extended <= 3.0.15 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload CVSS 6.4 · 27.05.202521.03.20268.8The Ultimate WordPress Toolkit – WP Extended <= 3.2.4 - Authenticated (Subscriber+) Privilege Escalation via Menu Editor Module CVSS 8.8 · 21.03.2026

Strategic Overview

Avg CVSSMedium
6.8/ 10
Patch Coverage100%
Open

0

Fixed

17

Get automatic notifications for all WP Extended – Modular WordPress Toolkit vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2026-4314

The Ultimate WordPress Toolkit – WP Extended <= 3.2.4 - Authenticated (Subscriber+) Privilege Escalation via Menu Editor Module

Read the full analysis

Vulnerability Records

17 records
2026-03-21 14:34CVE-2026-4314
8.8
High
bashuYes
2025-05-27 20:29CVE-2025-4963
6.4
Medium
rajanhoyrYes
2025-03-27 00:00CVE-2025-30796
6.1
Medium
Le Ngoc AnhYes
2025-02-11 15:21CVE-2024-13554
5.3
Medium
incognitoYes
2025-01-17 19:59CVE-2024-13184
7.5
High
stealthcopterYes
2025-01-07 00:00CVE-2024-11916
7.4
High
Lucio SáYes
2025-01-07 00:00CVE-2024-11816
8.8
High
stealthcopterYes
2024-10-16 00:00CVE-2024-9347
6.1
Medium
vgo0Yes
2024-09-30 00:00CVE-2024-47386
6.1
Medium
Le Ngoc AnhYes
2024-09-03 00:00CVE-2024-8121
5.4
Medium
Marco WotschkaYes
Showing 1–10 of 17 reports
WP Extended – Modular WordPress Toolkit banner
Latestv3.3.0

WP Extended – Modular WordPress Toolkit

WP Extended

Author

WP Extended

4.9(28)
98/100
Last Updated
2026-09-30 (1mo ago)
Active Installs
600+
Downloads
41,035
Requires WP
5.6+
Requires PHP
8.1+
Tested up to
WP 7.1.3
Created
2022-09-26 (4y ago)

Stop installing another plugin for every small WordPress job. WP Extended is a modular WordPress toolkit for the everyday jobs that usually send you searching for another plugin. Need to duplicate a page? Configure SMTP email? Upload SVG files? Manage code snippets? Switch between users? Change your WordPress login URL? Reorder content? Put a site into maintenance mode? WP Extended brings these tools — and many more — into one consistent plugin. Enable what your site needs. Leave the rest off. One toolkit. Individual modules. WP Extended is not designed around activating everything. Each capability is managed as its own module, so you choose the tools that fit your site. Enable a handful of modules on one WordPress site. Use a completely different combination on another. The same familiar toolkit sits underneath both. With WP Extended you can: Reduce reliance on small, single-purpose plugins Enable only the modules your site actually needs Manage everyday WordPress tools from one consistent interface Keep familiar workflows across the sites you build and maintain Start with useful functionality in the free plugin Add Pro functionality later where your workflow requires it Everyday WordPress jobs. One familiar toolkit. Duplicate Posts & Pages – Duplicate existing posts and pages without rebuilding the content or layout from scratch. Useful for landing pages, service pages, repeatable content structures and editorial workflows. SMTP Email – Configure WordPress email delivery through SMTP instead of adding another dedicated email plugin. Useful for site notifications, contact form delivery and transactional WordPress email. Code Snippets – Manage PHP, HTML, CSS and JavaScript snippets without editing your theme files. Keep small site customisations easier to find and maintain. SVG File Upload – Add SVG support to the WordPress media workflow for trusted logos, icons and scalable assets. User Switching – Switch between WordPress user accounts more quickly when testing permissions, troubleshooting issues or supporting users. Post Type Order – Reorder posts, pages and supported post types without writing custom code. Export Posts & Export Users – Export WordPress content and user data for reporting, migrations, audits and other workflows. Custom Login URL – Change the standard WordPress login path from the default URL. Limit Login Attempts – Restrict repeated login attempts and reduce common brute-force login activity. Maintenance Mode – Show visitors an appropriate maintenance page while work is taking place behind the scenes. Menu Editor – Rename, reorder or hide WordPress admin menu items to create a cleaner admin experience. Rollback Manager – Roll WordPress.org plugins or themes back to an earlier version when an update causes a problem. Browse every WP Extended module Built around the way you actually use WordPress. A large toolkit does not mean every feature should be active. That is why WP Extended is modular. Turn on SMTP on one site. Use Code Snippets and SVG uploads on another. Add content, admin or login tools where they make sense. Leave everything else disabled. Turn on what you need. Leave the rest off. A repeatable starting point for WordPress professionals. If you build or maintain WordPress sites regularly, the same small requirements tend to appear again and again: email delivery, content duplication, code snippets, user testing, SVG support, login controls, exports and admin customisation. Instead of finding and installing a different utility plugin every time one of those requirements appears, WP Extended gives you a familiar collection of tools you can configure around each project. That makes WP Extended particularly useful for: Freelancers building and maintaining client sites Agencies managing multiple WordPress websites Developers who want practical workflow and troubleshooting tools close at hand Site owners who want additional WordPress functionality without accumulating unnecessary standalone plugins Start free. Add more when your workflow needs it. WP Extended Free is designed to be useful on its own. Many modules are available directly through the WordPress.org plugin, while some modules include additional Pro functionality or are available with WP Extended Pro. You do not need to upgrade simply to understand how WP Extended works. Start with the tools your site needs today, and add more when your workflow requires them. Compare WP Extended Free and Pro What WP Extended is — and what it isn’t. WP Extended focuses on the small but important WordPress jobs that often end up spread across numerous utility plugins. It is not intended to replace every specialist WordPress product. For example, WP Extended is not positioned as a replacement for a complete: Security platform SEO platform Ecommerce system Backup service Page builder Performance or caching platform Those products solve larger specialist problems. WP Extended gives the everyday WordPress jobs a more consistent home. Why WP Extended? Modular by design – Enable the individual capabilities your site needs instead of activating an entire feature set. One familiar interface – Keep everyday WordPress tools together instead of remembering which standalone plugin controls which task. Less plugin sprawl – Reduce reliance on multiple small utility plugins that each solve one narrow requirement. Useful across multiple sites – Use the same familiar toolkit across different WordPress projects while configuring the modules differently for each one. Built for everyday WordPress work – WP Extended focuses on practical tasks that site owners, developers, freelancers and agencies repeatedly encounter. Extend WordPress. Not your plugin list. Every small WordPress requirement should not automatically mean installing another plugin. Install WP Extended and enable the modules your site actually needs. Website All modules Documentation Free vs Pro Changelog Support & contact

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C