Skip to content
PluginCanary

WP Extended - Modular WordPress Toolkit

by WP Extended · 600+ active installs · Checked 4 Nov 2026
Watch1 Warning

Watch: new committer wpextended made a first commit on 3 Nov 2026.

77/ 100 Canary Score
Sub-scores for WP Extended - Modular WordPress Toolkit
Ownership80
Maintenance100
Security60
Support70
Reputation70

How the score works

Active signals

Facts we detected, with links to the source.

  • WarningOWN-1New committer wpextended made a first commit on 3 Nov 2026. Review the latest release before updating, and consider disabling auto-updates for this plugin.3 Nov 2026Evidence
  • InfoSEC-37 vulnerabilities published in the last 24 months. Review this plugin.4 Nov 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
wpextended3 Nov 2026 to 3 Nov 2026, 2 commits

New committer wpextended made a first commit on 3 Nov 2026.

Maintenance

Last release
today
Releases, 24 months
1
Tested up to
7.1 current
Requires PHP
8.1 supported 8.2+
Releases per quarter for WP Extended - Modular WordPress Toolkit
Q1 20240
Q2 20240
Q3 20240
Q4 20240
Q1 20250
Q2 20250
Q3 20250
Q4 20250
Q1 20260
Q2 20260
Q3 20260
Q4 20261

Last release 3 Nov 2026. Tested with WordPress 7.1 (current).

Support

100% of 1 support threads resolved in the last 2 months.

Security record

PublishedIssueCVSSAffectedFixed inDays to patch
21 Mar 2026The Ultimate WordPress Toolkit – WP Extended <= 3.2.4 - Authenticated (Subscriber+) Privilege Escalation via Menu Editor Module8.8<= 3.2.43.2.5n/a
27 May 2025WP Extended <= 3.0.15 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4<= 3.0.153.0.16n/a
27 Mar 2025The Ultimate WordPress Toolkit – WP Extended <= 3.0.14 - Reflected Cross-Site Scripting6.1<= 3.0.143.0.15n/a
11 Feb 2025The Ultimate WordPress Toolkit – WP Extended <= 3.0.13 - Missing Authorization to Unauthenticated Post Order Manipulation5.3<= 3.0.133.0.14n/a
17 Jan 2025The Ultimate WordPress Toolkit – WP Extended <= 3.0.12 - Unauthenticated SQL Injection via Login Attempts Module7.5<= 3.0.123.0.13n/a
7 Jan 2025The Ultimate WordPress Toolkit – WP Extended <= 3.0.11 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution8.8<= 3.0.113.0.12n/a
7 Jan 2025The Ultimate WordPress Toolkit – WP Extended <= 3.0.11 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting7.4<= 3.0.113.0.12n/a
16 Oct 2024The Ultimate WordPress Toolkit – WP Extended <= 3.0.9 - Reflected Cross-Site Scripting6.1<= 3.0.9, 2.0.12, 3.0.113.0.10n/a
30 Sep 2024The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Reflected Cross-Site Scripting6.1<= 3.0.83.0.9n/a
3 Sep 2024The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Missing Authorization to Admin Username Change5.4<= 3.0.83.0.9n/a
3 Sep 2024The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Directory Traversal to Authenticated (Subscriber+) Arbitrary File Download8.8<= 3.0.83.0.9n/a
3 Sep 2024The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Reflected Cross-Site Scripting via page6.1<= 3.0.83.0.9n/a
3 Sep 2024The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Authenticated (Subscriber+) Sensitive Information Exposure6.5<= 3.0.83.0.9n/a
3 Sep 2024The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Authenticated (Subscriber+) Arbitrary Options Update8.8<= 3.0.83.0.9n/a
3 Sep 2024The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Insecure Direct Object Reference5.4<= 3.0.83.0.9n/a
3 Sep 2024The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Reflected Cross-Site Scripting via selected_option6.1<= 3.0.83.0.9n/a
27 Jun 2024The Ultimate WordPress Toolkit – WP Extended <= 2.4.7 - Unauthenticated Stored Cross-Site Scripting6.1<= 2.4.73.0.0n/a

Source: Wordfence Intelligence.

Reputation

Lifetime rating 4.9 from 28 ratings. Quarterly trends appear as new reviews arrive.

Rating distribution
5 star27
4 star0
3 star1
2 star0
1 star0

Momentum

600+ active installs. History builds with each weekly snapshot.

Momentum history builds with each snapshot.

Healthier alternatives

Same category, higher Canary Score. Never sponsored.

No healthier plugin in the same category yet.

Facts

Version3.4.0
AuthorWP Extended
Added26 Sep 2022
Last updated3 Nov 2026
Active installs600+
Requires WordPress5.6
Tested up to7.1.4
Requires PHP8.1
CategorySite Administration & Utilities > Site Health & Diagnostics
Tagssmtp, Admin Tools, custom columns, login designer, admin menu editor

Questions

Is WP Extended - Modular WordPress Toolkit still maintained?

WP Extended - Modular WordPress Toolkit was last updated on 3 Nov 2026. Its Canary status is Watch.

Is WP Extended - Modular WordPress Toolkit safe?

WP Extended - Modular WordPress Toolkit has no open unpatched vulnerabilities on record. 7 vulnerabilities were published in the last 24 months. Its Canary status is Watch.

Who owns WP Extended - Modular WordPress Toolkit?

The wordpress.org author is WP Extended. Recent committers: wpextended. New committer wpextended made a first commit on 3 Nov 2026.

What can I use instead of WP Extended - Modular WordPress Toolkit?

We have no healthier plugin in the same category on record yet.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews, Wordfence Intelligence.Plugin data refreshed 4 Nov 2026.Report a data issue