Nexcess vulnerabilities
27 vulnerabilities
Known vulnerabilities in Nexcess products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 9 products.
Products
9- Givewp12 vulnerabilities
- Event Tickets4 vulnerabilities
- Kadence Woocommerce Email Designer2 vulnerabilities
- The Events Calendar2 vulnerabilities
- Virtue/Ascend/Pinnacle Toolkit2 vulnerabilities
- Wpcomplete2 vulnerabilities
- Bookit1 vulnerabilities
- Gutenberg Blocks By Kadence Blocks1 vulnerabilities
- Starter Templates By Kadence WP1 vulnerabilities
CVE-2026-73352nexcessgivewp+1
EPSS score0.27%
Unauthenticated Broken Access Control in GiveWP <= 4.16.5.1 versions.CVE-2026-73997nexcessstarter templates by kadence wp+1EPSS score0.46%
Unauthenticated Denial of Service Attack in Starter Templates by Kadence WP <= 2.3.3 versions.CVE-2026-73348nexcessgivewp+1EPSS score0.27%
Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.CVE-2026-73357nexcessgivewp+1EPSS score0.22%
Donor Cross Site Scripting (XSS) in GiveWP < 4.16.6 versions.CVE-2026-73349nexcessgivewp+1EPSS score0.29%
Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.CVE-2026-84767nexcessbookit+1EPSS score0.18%
Unauthenticated Bypass Vulnerability in BookIt <= 2.6.0.3 versions.CVE-2026-65567nexcessevent tickets+1EPSS score0.29%
Unauthenticated Broken Access Control in Event Tickets <= 5.29.0.1 versions.CVE-2026-65473nexcessvirtue/ascend/pinnacle toolkit+1EPSS score0.22%
Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12 versions.CVE-2026-65441nexcessgivewp+1EPSS score0.25%
Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.3 versions.CVE-2026-65464nexcessgivewp+1EPSS score0.14%
Unauthenticated Cross Site Request Forgery (CSRF) in GiveWP <= 4.16.3 versions.CVE-2026-42750nexcesswpcomplete+1EPSS score0.22%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nexcess WPComplete wpcomplete allows Stored XSS.This issue affects WPComplete: from n/a through <= 2.9.5.4.CVE-2026-66696nexcessgutenberg blocks by kadence blocks+1EPSS score0.29%
Contributor Sensitive Data Exposure in Gutenberg Blocks by Kadence Blocks <= 3.7.8 versions.CVE-2026-66690nexcessgivewp+1EPSS score0.25%
Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.5 versions.CVE-2026-57705nexcessevent tickets+1EPSS score0.35%
Missing Authorization vulnerability in Nexcess Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through <= 5.28.5.CVE-2026-57661nexcesswpcomplete+1EPSS score0.29%
Subscriber Broken Access Control in WPComplete <= 2.9.5.5 versions.CVE-2026-94677nexcesskadence woocommerce email designer+1EPSS score0.40%
Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions.CVE-2026-104672nexcessgivewp+1EPSS score0.18%
Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions.CVE-2026-104405nexcessgivewp+1EPSS score0.28%
Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions.CVE-2026-93526nexcessevent tickets+1EPSS score0.18%
Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.4 versions.CVE-2026-28005nexcesskadence woocommerce email designer+1EPSS score0.48%
Unauthenticated Privilege Escalation in Kadence WooCommerce Email Designer <= 1.5.19 versions.