Nexcess

28 CVEs across 9 Nexcess products. Browse Nexcess vulnerabilities, severities, and proof-of-concept exploits.

Nexcess products with known CVEs

ProductCVEs
Givewp12
Event Tickets5
Kadence Woocommerce Email Designer2
The Events Calendar2
Virtue/ascend/pinnacle Toolkit2
Wpcomplete2
Bookit1
Gutenberg Blocks By Kadence Blocks1
Starter Templates By Kadence Wp1
Nexcess CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-104672High7.12026-10-06Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions.
CVE-2026-104405High8.12026-10-06Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions.
CVE-2026-97287High8.52026-09-30Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows…
CVE-2026-97285Medium5.42026-09-30Contributor Broken Access Control in The Events Calendar <= 6.17.5 versions.
CVE-2026-97266Medium6.52026-09-30Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12.1 versions.
CVE-2026-97066Medium5.32026-09-30Unauthenticated Insecure Direct Object References (IDOR) in GiveWP <= 4.16.9 versions.
CVE-2026-96834Medium6.52026-09-30Subscriber Sensitive Data Exposure in GiveWP <= 4.16.9 versions.
CVE-2026-96830High7.12026-09-30Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.9 versions.
CVE-2026-94677High7.22026-09-30Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions.
CVE-2026-93526High7.12026-09-23Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.4 versions.
CVE-2026-84767Medium5.32026-09-03Unauthenticated Bypass Vulnerability in BookIt <= 2.6.0.3 versions.
CVE-2026-78265Critical9.82026-08-24Unauthenticated PHP Object Injection in The Events Calendar <= 6.17.2 versions.
CVE-2026-78263High7.12026-08-24Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.2.1 versions.
CVE-2026-73997High7.52026-08-18Unauthenticated Denial of Service Attack in Starter Templates by Kadence WP <= 2.3.3 versions.
CVE-2026-73352Medium6.52026-08-18Unauthenticated Broken Access Control in GiveWP <= 4.16.5.1 versions.
CVE-2026-73348Medium6.52026-08-18Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.
CVE-2026-73357Medium6.52026-08-13Donor Cross Site Scripting (XSS) in GiveWP < 4.16.6 versions.
CVE-2026-73349Medium5.32026-08-13Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.
CVE-2026-66696Medium4.32026-08-06Contributor Sensitive Data Exposure in Gutenberg Blocks by Kadence Blocks <= 3.7.8 versions.
CVE-2026-66690High7.12026-08-06Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.5 versions.
CVE-2026-28005Critical9.82026-08-06Unauthenticated Privilege Escalation in Kadence WooCommerce Email Designer <= 1.5.19 versions.
CVE-2026-65441High7.12026-07-27Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.3 versions.
CVE-2026-65567Medium5.32026-07-27Unauthenticated Broken Access Control in Event Tickets <= 5.29.0.1 versions.
CVE-2026-65473Medium6.52026-07-23Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12 versions.
CVE-2026-65464Medium5.42026-07-23Unauthenticated Cross Site Request Forgery (CSRF) in GiveWP <= 4.16.3 versions.
CVE-2026-57705High7.52026-07-13Missing Authorization vulnerability in Nexcess Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a…
CVE-2026-57661Medium5.42026-06-26Subscriber Broken Access Control in WPComplete <= 2.9.5.5 versions.
CVE-2026-42750Medium6.52026-05-27Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nexcess WPComplete wpcomplete allows Stored XSS.This issu…