The Ultimate WordPress Toolkit – WP Extended

Reflected CrossSite Scripting via page vulnerability <= 3.0.8

Authenticated (Subscriber+) Sensitive Information Exposure vulnerability <= 3.0.8

Authenticated (Subscriber+) Arbitrary Options Update vulnerability <= 3.0.8

Insecure Direct Object Reference vulnerability <= 3.0.8

Directory Traversal to Authenticated (Subscriber+) Arbitrary File Download vulnerability <= 3.0.8