https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-13554.htmlhttps://patchthecve.com/cve/CVE-2024-13554.htmlWed, 17 Jun 2026 07:02:15 +0000MEDIUM 5.3: The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the reorder_route() function in all versions up to, and including, 3.0.13. This makes it possible for unauthenticated attackers to reorder poshttps://patchthecve.com/cve/CVE-2024-11916.htmlhttps://patchthecve.com/cve/CVE-2024-11916.htmlWed, 17 Jun 2026 06:58:41 +0000HIGH 7.4: The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification and retrieval of data due to a missing capability check on several functions in all versions up to, and including, 3.0.11. This makes it possible for authenticated attackers, with subscrihttps://patchthecve.com/cve/CVE-2024-9347.htmlhttps://patchthecve.com/cve/CVE-2024-9347.htmlWed, 17 Jun 2026 08:24:23 +0000MEDIUM 6.1: The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpext-export' parameter in all versions up to, and including, 3.0.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated athttps://patchthecve.com/cve/CVE-2024-8123.htmlhttps://patchthecve.com/cve/CVE-2024-8123.htmlWed, 17 Jun 2026 08:21:55 +0000MEDIUM 5.4: The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.0.8 via the duplicate_post function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, https://patchthecve.com/cve/CVE-2024-8121.htmlhttps://patchthecve.com/cve/CVE-2024-8121.htmlWed, 17 Jun 2026 08:21:55 +0000MEDIUM 5.4: The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification of user names due to a missing capability check on the wpext_change_admin_name() function in all versions up to, and including, 3.0.8. This makes it possible for authenticated attackers, https://patchthecve.com/cve/CVE-2024-8119.htmlhttps://patchthecve.com/cve/CVE-2024-8119.htmlWed, 17 Jun 2026 08:21:55 +0000MEDIUM 6.1: The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the page parameter in all versions up to, and including, 3.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers tohttps://patchthecve.com/cve/CVE-2024-8117.htmlhttps://patchthecve.com/cve/CVE-2024-8117.htmlWed, 17 Jun 2026 08:21:55 +0000MEDIUM 6.1: The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘selected_option’ parameter in all versions up to, and including, 3.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticatedhttps://patchthecve.com/cve/CVE-2024-8106.htmlhttps://patchthecve.com/cve/CVE-2024-8106.htmlWed, 17 Jun 2026 08:21:54 +0000MEDIUM 6.5: The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.8 via the download_user_ajax function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extrachttps://patchthecve.com/cve/CVE-2024-8104.htmlhttps://patchthecve.com/cve/CVE-2024-8104.htmlWed, 17 Jun 2026 08:21:52 +0000HIGH 8.8: The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.0.8 via the download_file_ajax function. This makes it possible for authenticated attackers, with subscriber access and above, to read the contents of arhttps://patchthecve.com/cve/CVE-2024-8102.htmlhttps://patchthecve.com/cve/CVE-2024-8102.htmlWed, 17 Jun 2026 08:21:52 +0000HIGH 8.8: The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the module_all_toggle_ajax() function in all versions up to, and including, 3.0.8. This makes it possiblhttps://patchthecve.com/cve/CVE-2024-37259.htmlhttps://patchthecve.com/cve/CVE-2024-37259.htmlWed, 17 Jun 2026 07:38:01 +0000HIGH 7.1: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Extended The Ultimate WordPress Toolkit – WP Extended wpextended.This issue affects The Ultimate WordPress Toolkit – WP Extended: from n/a through <= 2.4.7.