CVE Intelligence

Liquid Web / StellarWP vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Liquid Web / StellarWP products: 19 record(s), with severity, exploitation and fixes.

Event Tickets 6GiveWP 5The Events Calendar 2WPComplete 2Gutenberg Blocks by Kadence Blocks 2BookIt 1Advanced Post Manager 1

Exploited only (KEV) →

CVE-2026-96333 High · 7.5 CWE-290 Oct 9, 2026
WordPress GiveWP plugin <= 4.16.8.1 - Payment Bypass vulnerability
Authentication Bypass by Spoofing vulnerability in Liquid Web / StellarWP GiveWP give allows Identity Spoofing.This issue affects GiveWP: from n/a through 4.16.8.1.
CVE-2026-66479 High · 7.1 CWE-352 Oct 8, 2026
WordPress WPComplete plugin <= 2.9.5.6 - CSRF to Stored XSS vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Liquid Web / StellarWP WPComplete wpcomplete allows Stored XSS.This issue affects WPComplete: from n/a through 2.9.5.6.
CVE-2026-106600 Medium · 5.3 CWE-862 Oct 8, 2026
WordPress GiveWP plugin <= 4.18.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in Liquid Web / StellarWP GiveWP give allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GiveWP: from n/a through 4.18.0.
CVE-2026-105893 Medium · 5.3 CWE-639 Oct 8, 2026
WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Manipulating User-Controlled Variables.This issue affects Event Tickets: from n/a through 5.30.0.1.
CVE-2026-105891 Medium · 4.3 CWE-862 Oct 8, 2026
WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.0.1.
CVE-2026-105890 Medium · 6.5 CWE-79 Oct 8, 2026
WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.12 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.7.12.
CVE-2026-105888 Medium · 5.4 CWE-862 Oct 8, 2026
WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.0.1.
CVE-2026-95606 Critical · 9.8 CWE-502 Oct 7, 2026
WordPress The Events Calendar plugin <= 6.17.4 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP The Events Calendar allows Object Injection. This issue affects The Events Calendar: from n/a through 6.17.4.
CVE-2026-97283 Critical · 9.8 CWE-502 Oct 5, 2026
WordPress Advanced Post Manager plugin <= 4.5.5 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Object Injection.This issue affects Advanced Post Manager: from n/a through 4.5.5.
CVE-2026-104675 Medium · 4.3 CWE-862 Oct 5, 2026
WordPress Event Tickets plugin <= 5.30.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.0.
CVE-2026-104404 Medium · 6.5 CWE-79 Oct 5, 2026
WordPress GiveWP plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP GiveWP give allows Stored XSS.This issue affects GiveWP: from n/a through 4.17.0.
CVE-2026-103354 High · 7.1 CWE-79 Oct 4, 2026
WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.11.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.7.11.1.
CVE-2026-97287 High · 8.5 CWE-89 Sep 30, 2026
WordPress Event Tickets plugin <= 5.29.5 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Blind SQL Injection. This issue affects Event Tickets: from n/a through 5.29.5.
CVE-2026-66599 High · 7.1 CWE-79 Aug 24, 2026
WordPress WPComplete plugin <= 2.9.5.6 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in WPComplete <= 2.9.5.6 versions.
CVE-2026-49772 Critical · 9.3 CWE-89 Jun 16, 2026
WordPress The Events Calendar plugin 6.15.12-6.16.2 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP The Events Calendar allows Blind SQL Injection. This issue affects The Events Calendar: from 6.15.12 through 6.16.2.
CVE-2026-42662 Medium · 6.5 CWE-290 Jun 15, 2026
WordPress Event Tickets plugin <= 5.27.5 - Bypass Vulnerability vulnerability
Unauthenticated Bypass Vulnerability in Event Tickets <= 5.27.5 versions.
CVE-2026-34900 High · 7.1 CWE-79 Jun 15, 2026
WordPress GiveWP plugin <= 4.14.2 - Reflected Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.14.2 versions.
CVE-2026-40780 High · 7.5 CWE-288 Jun 2, 2026
WordPress BookIt plugin < 2.5.4.1 - Broken Authentication vulnerability
Authentication Bypass Using an Alternate Path or Channel vulnerability in Liquid Web / StellarWP BookIt allows Password Recovery Exploitation. This issue affects BookIt: from n/a before 2.5.4.1.
CVE-2026-42678 High · 7.1 CWE-79 Jun 1, 2026
WordPress GiveWP plugin <= 4.14.5 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP GiveWP allows DOM-Based XSS. This issue affects GiveWP: from n/a through 4.14.5.