Nexcess

17 CVEs across 8 Nexcess products. Browse Nexcess vulnerabilities, severities, and proof-of-concept exploits.

Nexcess products with known CVEs

ProductCVEs
Givewp7
Event Tickets3
Wpcomplete2
Gutenberg Blocks By Kadence Blocks1
Kadence Woocommerce Email Designer1
Starter Templates By Kadence Wp1
The Events Calendar1
Virtue/ascend/pinnacle Toolkit1
Nexcess CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-78265Critical9.82026-08-24Unauthenticated PHP Object Injection in The Events Calendar <= 6.17.2 versions.
CVE-2026-78263High7.12026-08-24Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.2.1 versions.
CVE-2026-73997High7.52026-08-18Unauthenticated Denial of Service Attack in Starter Templates by Kadence WP <= 2.3.3 versions.
CVE-2026-73352Medium6.52026-08-18Unauthenticated Broken Access Control in GiveWP <= 4.16.5.1 versions.
CVE-2026-73348Medium6.52026-08-18Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.
CVE-2026-73357Medium6.52026-08-13Donor Cross Site Scripting (XSS) in GiveWP < 4.16.6 versions.
CVE-2026-73349Medium5.32026-08-13Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.
CVE-2026-66696Medium4.32026-08-06Contributor Sensitive Data Exposure in Gutenberg Blocks by Kadence Blocks <= 3.7.8 versions.
CVE-2026-66690High7.12026-08-06Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.5 versions.
CVE-2026-28005Critical9.82026-08-06Unauthenticated Privilege Escalation in Kadence WooCommerce Email Designer <= 1.5.19 versions.
CVE-2026-65441High7.12026-07-27Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.3 versions.
CVE-2026-65567Medium5.32026-07-27Unauthenticated Broken Access Control in Event Tickets <= 5.29.0.1 versions.
CVE-2026-65473Medium6.52026-07-23Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12 versions.
CVE-2026-65464Medium5.42026-07-23Unauthenticated Cross Site Request Forgery (CSRF) in GiveWP <= 4.16.3 versions.
CVE-2026-57705High7.52026-07-13Missing Authorization vulnerability in Nexcess Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a…
CVE-2026-57661Medium5.42026-06-26Subscriber Broken Access Control in WPComplete <= 2.9.5.5 versions.
CVE-2026-42750Medium6.52026-05-27Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nexcess WPComplete wpcomplete allows Stored XSS.This issu…