CVE-2024-11916 HIGH

CVE-2024-11916: The Ultimate WordPress Toolkit – WP Extended <= 3.0.11 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting

Vendor Wpextended
Product The Ultimate WordPress Toolkit – WP Extended
Weakness CWE-862 · Missing authorization
Published January 8, 2025
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

7.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification and retrieval of data due to a missing capability check on several functions in all versions up to, and including, 3.0.11. This makes it possible for authenticated attackers, with subscriber-level access and above, to import and activate arbitrary code snippets along with

Key dates

02Disclosure timeline

January 8, 2025 CVE published
April 8, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-27344 WordPress inseri core plugin <= 1.0.5 - Broken Access Control vulnerability CVE-2024-54269 WordPress Notibar plugin <= 2.1.4 - Broken Access Control vulnerability CVE-2024-4010 Email Subscribers by Icegram Express <= 5.7.19 - Missing Authorization in handle_ajax_request CVE-2025-2568 Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce 1.0.4 - 1.2.1 - Missing Authorization to Unauthenticated Limited Arbitrary Options Update CVE-2025-53323 WordPress Pre-Publish Post Checklist plugin <= 3.1 - Broken Access Control Vulnerability