CVE Intelligence

Nexcess vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Nexcess products: 18 record(s), with severity, exploitation and fixes.

GiveWP 9Event Tickets 3WPComplete 2The Events Calendar 1Virtue/Ascend/Pinnacle Toolkit 1Kadence WooCommerce Email Designer 1Gutenberg Blocks by Kadence Blocks 1

Exploited only (KEV) →

CVE-2026-104672 High · 7.1 CWE-79 Oct 6, 2026
WordPress GiveWP plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions.
CVE-2026-104405 High · 8.1 CWE-266 Oct 6, 2026
WordPress GiveWP plugin <= 4.17.0 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions.
CVE-2026-78265 Critical · 9.8 CWE-502 Aug 24, 2026
WordPress The Events Calendar plugin <= 6.17.2 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in The Events Calendar <= 6.17.2 versions.
CVE-2026-78263 High · 7.1 CWE-79 Aug 24, 2026
WordPress Event Tickets plugin <= 5.29.2.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.2.1 versions.
CVE-2026-73352 Medium · 6.5 CWE-862 Aug 18, 2026
WordPress GiveWP plugin <= 4.16.5.1 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in GiveWP <= 4.16.5.1 versions.
CVE-2026-73348 Medium · 6.5 CWE-862 Aug 18, 2026
WordPress GiveWP plugin < 4.16.6 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.
CVE-2026-73357 Medium · 6.5 CWE-79 Aug 13, 2026
WordPress GiveWP plugin < 4.16.6 - Cross Site Scripting (XSS) vulnerability
Donor Cross Site Scripting (XSS) in GiveWP < 4.16.6 versions.
CVE-2026-73349 Medium · 5.3 CWE-862 Aug 13, 2026
WordPress GiveWP plugin < 4.16.6 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.
CVE-2026-66696 Medium · 4.3 CWE-201 Aug 6, 2026
WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.8 - Sensitive Data Exposure vulnerability
Contributor Sensitive Data Exposure in Gutenberg Blocks by Kadence Blocks <= 3.7.8 versions.
CVE-2026-66690 High · 7.1 CWE-79 Aug 6, 2026
WordPress GiveWP plugin <= 4.16.5 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.5 versions.
CVE-2026-28005 Critical · 9.8 CWE-862 Aug 6, 2026
WordPress Kadence WooCommerce Email Designer plugin <= 1.5.19 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Kadence WooCommerce Email Designer <= 1.5.19 versions.
CVE-2026-65441 High · 7.1 CWE-79 Jul 27, 2026
WordPress GiveWP plugin <= 4.16.3 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.3 versions.
CVE-2026-65567 Medium · 5.3 CWE-862 Jul 27, 2026
WordPress Event Tickets plugin <= 5.29.0.1 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Event Tickets <= 5.29.0.1 versions.
CVE-2026-65473 Medium · 6.5 CWE-79 Jul 23, 2026
WordPress Virtue/Ascend/Pinnacle Toolkit plugin <= 4.9.12 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12 versions.
CVE-2026-65464 Medium · 5.4 CWE-352 Jul 23, 2026
WordPress GiveWP plugin <= 4.16.3 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery (CSRF) in GiveWP <= 4.16.3 versions.
CVE-2026-57705 High · 7.5 CWE-862 Jul 13, 2026
WordPress Event Tickets plugin <= 5.28.5 - Broken Access Control vulnerability
Missing Authorization vulnerability in Nexcess Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through <= 5.28.5.
CVE-2026-57661 Medium · 5.4 CWE-862 Jun 26, 2026
WordPress WPComplete plugin <= 2.9.5.5 - Broken Access Control vulnerability
Subscriber Broken Access Control in WPComplete <= 2.9.5.5 versions.
CVE-2026-42750 Medium · 6.5 CWE-79 May 27, 2026
WordPress WPComplete plugin <= 2.9.5.4 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nexcess WPComplete wpcomplete allows Stored XSS.This issue affects WPComplete: from n/a through <= 2.9.5.4.