Nexcess vulnerabilities

Products

• GiveWP 12
• Event Tickets 4
• Kadence WooCommerce Email Designer 2
• The Events Calendar 2
• Virtue/Ascend/Pinnacle Toolkit 2
• WPComplete 2
• BookIt 1
• Gutenberg Blocks by Kadence Blocks 1
• Starter Templates by Kadence WP 1

Latest Nexcess CVEs

Newest publication first · page 1 of 2

1. CVE-2026-116853 WordPress GiveWP plugin <= 4.19.0.1 - Broken Access Control vulnerability

   Published 2026-10-30

   Medium·CVSS 6.5 EPSS 0.21%

   Unauthenticated Broken Access Control in GiveWP <= 4.19.0.1 versions.

2. CVE-2026-104672 WordPress GiveWP plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability

   Published 2026-10-06

   High·CVSS 7.1 EPSS 0.18%

   Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions.

3. CVE-2026-104405 WordPress GiveWP plugin <= 4.17.0 - Privilege Escalation vulnerability

   Published 2026-10-06

   High·CVSS 8.1 EPSS 0.27%

   Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions.

4. CVE-2026-97285 WordPress The Events Calendar plugin <= 6.17.5 - Broken Access Control vulnerability

   Published 2026-09-30

   Medium·CVSS 5.4 EPSS 0.20%

   Contributor Broken Access Control in The Events Calendar <= 6.17.5 versions.

5. CVE-2026-97266 WordPress Virtue/Ascend/Pinnacle Toolkit plugin <= 4.9.12.1 - Cross Site Scripting (XSS) vulnerability

   Published 2026-09-30

   Medium·CVSS 6.5 EPSS 0.13%

   Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12.1 versions.

6. CVE-2026-97066 WordPress GiveWP plugin <= 4.16.9 - Insecure Direct Object References (IDOR) vulnerability

   Published 2026-09-30

   Medium·CVSS 5.3 EPSS 0.22%

   Unauthenticated Insecure Direct Object References (IDOR) in GiveWP <= 4.16.9 versions.

7. CVE-2026-96830 WordPress GiveWP plugin <= 4.16.9 - Cross Site Scripting (XSS) vulnerability

   Published 2026-09-30

   High·CVSS 7.1 EPSS 0.19%

   Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.9 versions.

8. CVE-2026-94677 WordPress Kadence WooCommerce Email Designer plugin <= 1.5.19.1 - PHP Object Injection vulnerability

   Published 2026-09-30

   High·CVSS 7.2 EPSS 0.39%

   Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions.

9. CVE-2026-93526 WordPress Event Tickets plugin <= 5.29.4 - Cross Site Scripting (XSS) vulnerability

   Published 2026-09-23

   High·CVSS 7.1 EPSS 0.25%

   Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.4 versions.

10. CVE-2026-84767 WordPress BookIt plugin <= 2.6.0.3 - Bypass Vulnerability vulnerability

    Published 2026-09-03

    Medium·CVSS 5.3 EPSS 0.18%

    Unauthenticated Bypass Vulnerability in BookIt <= 2.6.0.3 versions.

11. CVE-2026-78265 WordPress The Events Calendar plugin <= 6.17.2 - PHP Object Injection vulnerability

    Published 2026-08-24

    Critical·CVSS 9.8 EPSS 0.56%

    Unauthenticated PHP Object Injection in The Events Calendar <= 6.17.2 versions.

12. CVE-2026-78263 WordPress Event Tickets plugin <= 5.29.2.1 - Cross Site Scripting (XSS) vulnerability

    Published 2026-08-24

    High·CVSS 7.1 EPSS 0.25%

    Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.2.1 versions.

13. CVE-2026-73997 WordPress Starter Templates by Kadence WP plugin <= 2.3.3 - Denial of Service Attack vulnerability

    Published 2026-08-18

    High·CVSS 7.5 EPSS 0.46%

    Unauthenticated Denial of Service Attack in Starter Templates by Kadence WP <= 2.3.3 versions.

14. CVE-2026-73352 WordPress GiveWP plugin <= 4.16.5.1 - Broken Access Control vulnerability

    Published 2026-08-18

    Medium·CVSS 6.5 EPSS 0.27%

    Unauthenticated Broken Access Control in GiveWP <= 4.16.5.1 versions.

15. CVE-2026-73348 WordPress GiveWP plugin < 4.16.6 - Broken Access Control vulnerability

    Published 2026-08-18

    Medium·CVSS 6.5 EPSS 0.27%

    Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.

16. CVE-2026-73357 WordPress GiveWP plugin < 4.16.6 - Cross Site Scripting (XSS) vulnerability

    Published 2026-08-13

    Medium·CVSS 6.5 EPSS 0.22%

    Donor Cross Site Scripting (XSS) in GiveWP < 4.16.6 versions.

17. CVE-2026-73349 WordPress GiveWP plugin < 4.16.6 - Broken Access Control vulnerability

    Published 2026-08-13

    Medium·CVSS 5.3 EPSS 0.29%

    Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.

18. CVE-2026-66696 WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.8 - Sensitive Data Exposure vulnerability

    Published 2026-08-06

    Medium·CVSS 4.3 EPSS 0.30%

    Contributor Sensitive Data Exposure in Gutenberg Blocks by Kadence Blocks <= 3.7.8 versions.

19. CVE-2026-66690 WordPress GiveWP plugin <= 4.16.5 - Cross Site Scripting (XSS) vulnerability

    Published 2026-08-06

    High·CVSS 7.1 EPSS 0.25%

    Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.5 versions.

20. CVE-2026-28005 WordPress Kadence WooCommerce Email Designer plugin <= 1.5.19 - Privilege Escalation vulnerability

    Published 2026-08-06

    Critical·CVSS 9.8 EPSS 0.48%

    Unauthenticated Privilege Escalation in Kadence WooCommerce Email Designer <= 1.5.19 versions.

21. CVE-2026-65441 WordPress GiveWP plugin <= 4.16.3 - Cross Site Scripting (XSS) vulnerability

    Published 2026-07-27

    High·CVSS 7.1 EPSS 0.25%

    Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.3 versions.

22. CVE-2026-65567 WordPress Event Tickets plugin <= 5.29.0.1 - Broken Access Control vulnerability

    Published 2026-07-27

    Medium·CVSS 5.3 EPSS 0.29%

    Unauthenticated Broken Access Control in Event Tickets <= 5.29.0.1 versions.

23. CVE-2026-65473 WordPress Virtue/Ascend/Pinnacle Toolkit plugin <= 4.9.12 - Cross Site Scripting (XSS) vulnerability

    Published 2026-07-23

    Medium·CVSS 6.5 EPSS 0.22%

    Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12 versions.

24. CVE-2026-65464 WordPress GiveWP plugin <= 4.16.3 - Cross Site Request Forgery (CSRF) vulnerability

    Published 2026-07-23

    Medium·CVSS 5.4 EPSS 0.14%

    Unauthenticated Cross Site Request Forgery (CSRF) in GiveWP <= 4.16.3 versions.

25. CVE-2026-57705 WordPress Event Tickets plugin <= 5.28.5 - Broken Access Control vulnerability

    Published 2026-07-13

    High·CVSS 7.5 EPSS 0.35%

    Missing Authorization vulnerability in Nexcess Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through <= 5.28.5.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.