Threat database

CVE-2026-66599 is a high-severity vulnerability in the WPComplete plugin by Liquid Web / StellarWP. It is an unauthenticated Cross-Site Scripting (XSS) flaw affecting versions up to and including 2.9.5.6. This vulnerability involves improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts. No official patch or remediation guidance has been provided yet.

CVE-2026-49772 is a critical SQL Injection vulnerability in Liquid Web / StellarWP The Events Calendar plugin versions from 6.15.12 through 6.16.2. It allows an attacker to perform Blind SQL Injection, potentially leading to high confidentiality impact and limited availability impact. No official patch or remediation guidance is currently provided by the vendor. No known exploits are reported in the wild.

Unauthenticated Bypass Vulnerability in Event Tickets <= 5.27.5 versions.

CVE-2026-34900 is a high-severity vulnerability in GiveWP versions up to and including 4.14.2. It is an unauthenticated cross-site scripting (XSS) flaw that allows improper neutralization of input during web page generation. This vulnerability can lead to partial compromise of confidentiality, integrity, and availability of the affected system.

Authentication Bypass Using an Alternate Path or Channel vulnerability in Liquid Web / StellarWP BookIt allows Password Recovery Exploitation. This issue affects BookIt: from n/a before 2.5.4.1.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP GiveWP allows DOM-Based XSS. This issue affects GiveWP: from n/a through 4.14.5.

Improper Control of Generation of Code ('Code Injection') vulnerability in Liquid Web / StellarWP GiveWP give allows Code Injection.This issue affects GiveWP: from n/a through 4.13.1.