WP Extended — Vulnerabilities & Security Advisories 3

WP Extended is a WordPress plugin designed to extend core functionality with features like custom post types and taxonomies. Historically, it has been vulnerable to multiple security issues including cross-site scripting (XSS), remote code execution (RCE), and privilege escalation vulnerabilities. The plugin has three CVEs on record, with one notable incident involving an authenticated RCE flaw (CVE-2023-6552) that allowed attackers with contributor-level access to execute arbitrary code. Security researchers have identified consistent input validation and sanitization weaknesses across versions, making it a persistent target for exploitation. Despite its utility, the plugin's security track record has raised concerns among WordPress administrators regarding its risk profile.