Liquid Web vulnerabilities and threats

CVE-2026-82222 is a critical vulnerability in Liquid Web / StellarWP GiveWP involving deserialization of untrusted data, which allows object injection. The vulnerability affects GiveWP versions up to 4.16.7.1. It has a CVSS score of 10.0, indicating a critical severity with network attack vector, no privileges required, no user interaction, and complete confidentiality, integrity, and availability impact. No official patch or remediation information is currently available.

CVE-2026-32550 is a high severity SQL Injection vulnerability affecting Kadence Shop Kit versions up to 3.0.6. It allows an attacker with low privileges and no user interaction to cause a partial denial of service and potentially gain high confidentiality impact via improper neutralization of special elements in SQL commands.

CVE-2026-66599 is a high-severity vulnerability in the WPComplete plugin by Liquid Web / StellarWP. It is an unauthenticated Cross-Site Scripting (XSS) flaw affecting versions up to and including 2.9.5.6. This vulnerability involves improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts. No official patch or remediation guidance has been provided yet.

CVE-2026-49772 is a critical SQL Injection vulnerability in Liquid Web / StellarWP The Events Calendar plugin versions from 6.15.12 through 6.16.2. It allows an attacker to perform Blind SQL Injection, potentially leading to high confidentiality impact and limited availability impact. No official patch or remediation guidance is currently provided by the vendor. No known exploits are reported in the wild.

Unauthenticated Bypass Vulnerability in Event Tickets <= 5.27.5 versions.

CVE-2026-34900 is a high-severity vulnerability in GiveWP versions up to and including 4.14.2. It is an unauthenticated cross-site scripting (XSS) flaw that allows improper neutralization of input during web page generation. This vulnerability can lead to partial compromise of confidentiality, integrity, and availability of the affected system.

Authentication Bypass Using an Alternate Path or Channel vulnerability in Liquid Web / StellarWP BookIt allows Password Recovery Exploitation. This issue affects BookIt: from n/a before 2.5.4.1.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP GiveWP allows DOM-Based XSS. This issue affects GiveWP: from n/a through 4.14.5.

Improper Control of Generation of Code ('Code Injection') vulnerability in Liquid Web / StellarWP GiveWP give allows Code Injection.This issue affects GiveWP: from n/a through 4.13.1.

Deserialization of Untrusted Data vulnerability in Liquid Web GiveWP allows Object Injection.This issue affects GiveWP: from n/a through 3.14.1.