Nexcess

Records28All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high10CVSS 7.0–8.9

Exploited now

Nexcess records in CISA KEV

No Nexcess vulnerabilities are listed in CISA KEV.

Records

28 records

TI-2026-54437 CVE-2026-78265 · GHSA-9prr-67qp-hf9r

WordPress The Events Calendar plugin <= 6.17.2 - PHP Object Injection vulnerability

MEDIUM 50

Unauthenticated PHP Object Injection in The Events Calendar <= 6.17.2 versions.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00564 Published 2026-08-24 No fix listed CWE-502

TI-2026-22346 CVE-2026-28005 · GHSA-x6xp-4xjv-q7c6

WordPress Kadence WooCommerce Email Designer plugin <= 1.5.19 - Privilege Escalation vulnerability

MEDIUM 49

Unauthenticated Privilege Escalation in Kadence WooCommerce Email Designer <= 1.5.19 versions.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00483 Published 2026-08-06 No fix listed CWE-862

TI-2026-51987 CVE-2026-73997 · GHSA-4pmh-h6pj-3wh3

WordPress Starter Templates by Kadence WP plugin <= 2.3.3 - Denial of Service Attack vulnerability

LOW 39

Unauthenticated Denial of Service Attack in Starter Templates by Kadence WP <= 2.3.3 versions.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0046 Published 2026-08-18 No fix listed CWE-770

TI-2026-41529 CVE-2026-57705 · GHSA-pjjq-j3p4-7r6f

WordPress Event Tickets plugin <= 5.28.5 - Broken Access Control vulnerability

LOW 39

Missing Authorization vulnerability in Nexcess Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through <= 5.28.5.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00346 Published 2026-07-13 No fix listed CWE-862

TI-2026-68292 CVE-2026-104405 · GHSA-gqc7-m99j-qx7h

Privilege escalation in GiveWP WordPress plugin

LOW 37

Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00274 Published 2026-10-06 No fix listed CWE-266

TI-2026-83312 CVE-2026-116853 · GHSA-5xg3-xvhc-jc3h

Broken access control in GiveWP WordPress plugin

LOW 34

Unauthenticated Broken Access Control in GiveWP <= 4.19.0.1 versions.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00207 Published 2026-10-30 No fix listed CWE-862

TI-2026-63488 CVE-2026-94677 · GHSA-jppp-m2g8-7jvx

WordPress Kadence WooCommerce Email Designer plugin <= 1.5.19.1 - PHP Object Injection vulnerability

LOW 34

Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00388 Published 2026-09-30 No fix listed CWE-502

TI-2026-51472 CVE-2026-73352 · GHSA-mr6c-6rqv-xmmh

WordPress GiveWP plugin <= 4.16.5.1 - Broken Access Control vulnerability

LOW 34

Unauthenticated Broken Access Control in GiveWP <= 4.16.5.1 versions.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00266 Published 2026-08-18 No fix listed CWE-862

TI-2026-51468 CVE-2026-73348 · GHSA-h968-wg7c-wxj2

WordPress GiveWP plugin < 4.16.6 - Broken Access Control vulnerability

LOW 34

Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00266 Published 2026-08-18 Fixed in 4.16.6 CWE-862

TI-2026-63892 CVE-2026-96830 · GHSA-gf2p-qf7r-pch8

WordPress GiveWP plugin <= 4.16.9 - Cross Site Scripting (XSS) vulnerability

LOW 31

Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.9 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00195 Published 2026-09-30 No fix listed CWE-79

TI-2026-63009 CVE-2026-93526 · GHSA-gq87-59xc-vp2x

WordPress Event Tickets plugin <= 5.29.4 - Cross Site Scripting (XSS) vulnerability

LOW 31

Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.4 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00251 Published 2026-09-23 No fix listed CWE-79

TI-2026-54435 CVE-2026-78263 · GHSA-58c6-r3gj-j8x2

WordPress Event Tickets plugin <= 5.29.2.1 - Cross Site Scripting (XSS) vulnerability

LOW 31

Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.2.1 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00251 Published 2026-08-24 No fix listed CWE-79

TI-2026-47358 CVE-2026-66690 · GHSA-q64f-8jfv-6r69

WordPress GiveWP plugin <= 4.16.5 - Cross Site Scripting (XSS) vulnerability

LOW 31

Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.5 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00251 Published 2026-08-06 No fix listed CWE-79

TI-2026-46613 CVE-2026-65441 · GHSA-8v92-4x68-8f2h

WordPress GiveWP plugin <= 4.16.3 - Cross Site Scripting (XSS) vulnerability

LOW 31

Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.3 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00251 Published 2026-07-27 No fix listed CWE-79

TI-2026-68295 CVE-2026-104672 · GHSA-p94p-49gp-mjj2

Cross-site scripting in WordPress GiveWP plugin

LOW 30

Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00175 Published 2026-10-06 No fix listed CWE-79

TI-2026-51469 CVE-2026-73349 · GHSA-22r8-gvpx-mqwv

WordPress GiveWP plugin < 4.16.6 - Broken Access Control vulnerability

LOW 30

Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00294 Published 2026-08-13 Fixed in 4.16.6 CWE-862

TI-2026-63941 CVE-2026-97066 · GHSA-wmfw-j7p7-g9fp

WordPress GiveWP plugin <= 4.16.9 - Insecure Direct Object References (IDOR) vulnerability

LOW 29

Unauthenticated Insecure Direct Object References (IDOR) in GiveWP <= 4.16.9 versions.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00225 Published 2026-09-30 No fix listed CWE-639

TI-2026-63896 CVE-2026-96834 · GHSA-xwww-243m-34r8

WordPress GiveWP plugin <= 4.16.9 - Sensitive Data Exposure vulnerability

LOW 29

Subscriber Sensitive Data Exposure in GiveWP <= 4.16.9 versions.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0032 Published 2026-09-30 No fix listed CWE-862

TI-2026-58268 CVE-2026-84767 · GHSA-vg3m-xq6r-8qfh

WordPress BookIt plugin <= 2.6.0.3 - Bypass Vulnerability vulnerability

LOW 29

Unauthenticated Bypass Vulnerability in BookIt <= 2.6.0.3 versions.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00176 Published 2026-09-03 No fix listed CWE-345

TI-2026-64001 CVE-2026-97266 · GHSA-67cw-qmp2-95xv

WordPress Virtue/Ascend/Pinnacle Toolkit plugin <= 4.9.12.1 - Cross Site Scripting (XSS) vulnerability

LOW 28

Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12.1 versions.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00127 Published 2026-09-30 No fix listed CWE-79

TI-2026-51477 CVE-2026-73357 · GHSA-hmhg-vxc9-cg47

WordPress GiveWP plugin < 4.16.6 - Cross Site Scripting (XSS) vulnerability

LOW 28

Donor Cross Site Scripting (XSS) in GiveWP < 4.16.6 versions.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00224 Published 2026-08-13 Fixed in 4.16.6 CWE-79

TI-2026-46643 CVE-2026-65473 · GHSA-h83f-3329-47h2

WordPress Virtue/Ascend/Pinnacle Toolkit plugin <= 4.9.12 - Cross Site Scripting (XSS) vulnerability

LOW 28

Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12 versions.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00224 Published 2026-07-23 No fix listed CWE-79

TI-2026-30973 CVE-2026-42750 · GHSA-388h-jxj2-x3jp

WordPress WPComplete plugin <= 2.9.5.4 - Cross Site Scripting (XSS) vulnerability

LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nexcess WPComplete wpcomplete allows Stored XSS.This issue affects WPComplete: from n/a through <= 2.9.5.4.