CVE-2024-11916

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-11916
The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification and retrieval of data due to a missing capability check on several functions in all versions up to, and including, 3.0.11. This makes it possible for authenticated attackers, with subscriber-level access and above, to import and activate arbitrary code snippets along with

5.4 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3213331%40wpextended&new=3213331%40wpextended&sfp_email=&sfph_mail= Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/747d7649-bdf5-46d0-a496-59cb7eac77ac?source=cve Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:wpextended:wp_extended:*:*:*:*:*:wordpress:*:*
History

14 Apr 2025, 12:27

Type Values Removed Values Added
CPE cpe:2.3:a:wpextended:ultimate_wordpress_toolkit:*:*:*:*:*:wordpress:*:* cpe:2.3:a:wpextended:wp_extended:*:*:*:*:*:wordpress:*:*
First Time Wpextended wp Extended

17 Jan 2025, 20:58

Type Values Removed Values Added
CWE CWE-862 CWE-79
CVSS v2 : unknown
v3 : 7.4 		v2 : unknown
v3 : 5.4
CPE cpe:2.3:a:wpextended:ultimate_wordpress_toolkit:*:*:*:*:*:wordpress:*:*
First Time Wpextended
Wpextended ultimate Wordpress Toolkit
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/747d7649-bdf5-46d0-a496-59cb7eac77ac?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/747d7649-bdf5-46d0-a496-59cb7eac77ac?source=cve - Third Party Advisory
References () https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3213331%40wpextended&new=3213331%40wpextended&sfp_email=&sfph_mail= - () https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3213331%40wpextended&new=3213331%40wpextended&sfp_email=&sfph_mail= - Patch

08 Jan 2025, 04:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-01-08 04:15

Updated : 2025-04-14 12:27

NVD link : CVE-2024-11916

Mitre link : CVE-2024-11916

JSON object : View

Products Affected

wpextended

  • wp_extended
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')