Threat database

28 threats

Threat database
Severity	CVSS	Signals	Threat	Source	Published
Critical	9.8	EPSS 0.5%	CVE-2026-28005Kadence WooCommerce Email Designer · Missing Authorization Critical9.8EPSS 0.5%2026-08-06CVE Database V5CVE-2026-28005 CVE-2026-28005 is a critical vulnerability in Nexcess Kadence WooCommerce Email Designer versions up to and including 1.5.19. It allows unauthenticated users to escalate privileges due to missing authorization checks. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time. EPSS 0.5%Vulnerability Nexcess #cwe-862 #ghsa-x6xp-4xjv-q7c6	CVE Database V5	2026-08-06
High	7.1	EPSS 0.3%	CVE-2026-65441GiveWP · Cross-site Scripting High7.1EPSS 0.3%2026-07-27CVE Database V5CVE-2026-65441 Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.3 versions. EPSS 0.3%Vulnerability Nexcess #cwe-79	CVE Database V5	2026-07-27
Medium	5.3	EPSS 0.3%	CVE-2026-65567Event Tickets · Missing Authorization Medium5.3EPSS 0.3%2026-07-27CVE Database V5CVE-2026-65567 Unauthenticated Broken Access Control in Event Tickets <= 5.29.0.1 versions. EPSS 0.3%Vulnerability Nexcess #cwe-862	CVE Database V5	2026-07-27
Medium	6.5	EPSS 0.2%	CVE-2026-65473Virtue/Ascend/Pinnacle Toolkit · Cross-site Scripting Medium6.5EPSS 0.2%2026-07-23CVE Database V5CVE-2026-65473 Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12 versions. EPSS 0.2%Vulnerability Nexcess #cwe-79	CVE Database V5	2026-07-23
Medium	5.4	EPSS 0.1%	CVE-2026-65464GiveWP · Cross-Site Request Forgery (CSRF) Medium5.4EPSS 0.1%2026-07-23CVE Database V5CVE-2026-65464 Unauthenticated Cross Site Request Forgery (CSRF) in GiveWP <= 4.16.3 versions. EPSS 0.1%Vulnerability Nexcess #cwe-352	CVE Database V5	2026-07-23
High	7.5	EPSS 0.3%	CVE-2026-57705Event Tickets · Missing Authorization High7.5EPSS 0.3%2026-07-13CVE Database V5CVE-2026-57705 Missing Authorization vulnerability in Nexcess Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through <= 5.28.5. EPSS 0.3%Vulnerability Nexcess #cwe-862	CVE Database V5	2026-07-13
Medium	5.4	EPSS 0.3%	CVE-2026-57661WPComplete · Missing Authorization Medium5.4EPSS 0.3%2026-06-26CVE Database V5CVE-2026-57661 Subscriber Broken Access Control in WPComplete <= 2.9.5.5 versions. EPSS 0.3%Vulnerability Nexcess #cwe-862	CVE Database V5	2026-06-26
Medium	6.5	EPSS 0.2%	CVE-2026-42750WPComplete · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Nexcess… Medium6.5EPSS 0.2%2026-05-27CVE Database V5CVE-2026-42750 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nexcess WPComplete wpcomplete allows Stored XSS.This issue affects WPComplete: from n/a through <= 2.9.5.4. EPSS 0.2%Vulnerability Nexcess	CVE Database V5	2026-05-27

Showing 21–28 of 28 results