Wpextended Wp Extended vulnerabilities

CVE-2024-37259 [MEDIUM] CWE-79 CVE-2024-37259: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Extended The Ultimate WordPress Toolkit – WP Extended wpextended.This issue affects The Ultimate WordPress Toolkit – WP Extended: from n/a through <= 2.4.7.

CVE-2024-8102 [HIGH] CWE-862 CVE-2024-8102: The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the module_all_toggle_ajax() function in all versions up to, and including, 3.0.8. This makes it possible for authenticated attackers, with Subscriber-level acc

CVE-2024-8104 [MEDIUM] CWE-22 CVE-2024-8104: The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Directory Tra The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.0.8 via the download_file_ajax function. This makes it possible for authenticated attackers, with subscriber access and above, to read the contents of arbitrary files on the server, which can contain sensiti

CVE-2024-8106 [MEDIUM] CWE-200 CVE-2024-8106: The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Sensitive Inf The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.8 via the download_user_ajax function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive data including usernames, hashed password

CVE-2024-8123 [MEDIUM] CWE-639 CVE-2024-8123: The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Insecure Dire The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.0.8 via the duplicate_post function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to duplicate

CVE-2024-13554 [MEDIUM] CWE-862 CVE-2024-13554: The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the reorder_route() function in all versions up to, and including, 3.0.13. This makes it possible for unauthenticated attackers to reorder posts.

CVE-2024-11916 [MEDIUM] CWE-862 CVE-2024-11916: The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification and retrieval of data due to a missing capability check on several functions in all versions up to, and including, 3.0.11. This makes it possible for authenticated attackers, with subscriber-level access and above, to import and activate a

CVE-2024-9347 [MEDIUM] CWE-79 CVE-2024-9347: The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Reflected Cro The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpext-export' parameter in all versions up to, and including, 3.0.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that

CVE-2024-8117 [MEDIUM] CWE-79 CVE-2024-8117: The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Reflected Cro The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘selected_option’ parameter in all versions up to, and including, 3.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages th

CVE-2024-8119 [MEDIUM] CWE-79 CVE-2024-8119: The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Reflected Cro The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the page parameter in all versions up to, and including, 3.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if

CVE-2024-8121 [MEDIUM] CWE-862 CVE-2024-8121: The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification of user names due to a missing capability check on the wpext_change_admin_name() function in all versions up to, and including, 3.0.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change an a