extendons — Vulnerabilities & Security Advisories 4

Extendons develops WordPress plugins primarily for enhancing website functionality through contact forms, sliders, and marketing tools. Historically, their plugins have been vulnerable to multiple remote code execution (RCE) and cross-site scripting (XSS) flaws, often stemming from insufficient input validation and improper sanitization. Several critical vulnerabilities allowed attackers to execute arbitrary code or steal sensitive user data. In 2021, a privilege escalation weakness in their Contact Form Builder plugin enabled unauthorized access to administrative functions. Despite patches, recurring security issues suggest inadequate secure coding practices, making their extensions frequent targets in WordPress exploitation campaigns.