Threat database

28 threats

Threat database
Severity	CVSS	Signals	Threat	Source	Published
High	7.1	EPSS 0.2%	CVE-2026-104672GiveWP · Cross-site Scripting High7.1EPSS 0.2%2026-10-06CVE Database V5CVE-2026-104672 Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions. EPSS 0.2%Vulnerability Nexcess #cwe-79	CVE Database V5	2026-10-06
High	8.1	EPSS 0.3%	CVE-2026-104405GiveWP · Incorrect Privilege Assignment High8.1EPSS 0.3%2026-10-06CVE Database V5CVE-2026-104405 Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions. EPSS 0.3%Vulnerability Nexcess #cwe-266	CVE Database V5	2026-10-06
Medium	5.4	EPSS 0.2%	CVE-2026-97285The Events Calendar · Missing Authorization Medium5.4EPSS 0.2%2026-09-30CVE Database V5CVE-2026-97285 Contributor Broken Access Control in The Events Calendar <= 6.17.5 versions. EPSS 0.2%Vulnerability Nexcess #cwe-862	CVE Database V5	2026-09-30
Medium	6.5	EPSS 0.1%	CVE-2026-97266Virtue/Ascend/Pinnacle Toolkit · Cross-site Scripting Medium6.5EPSS 0.1%2026-09-30CVE Database V5CVE-2026-97266 Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12.1 versions. EPSS 0.1%Vulnerability Nexcess #cwe-79	CVE Database V5	2026-09-30
Medium	5.3	EPSS 0.2%	CVE-2026-97066GiveWP · Authorization Bypass Through User-Controlled Key Medium5.3EPSS 0.2%2026-09-30CVE Database V5CVE-2026-97066 Unauthenticated Insecure Direct Object References (IDOR) in GiveWP <= 4.16.9 versions. EPSS 0.2%Vulnerability Nexcess #cwe-639	CVE Database V5	2026-09-30
Medium	6.5	EPSS 0.3%	CVE-2026-96834GiveWP · Missing Authorization Medium6.5EPSS 0.3%2026-09-30CVE Database V5CVE-2026-96834 Subscriber Sensitive Data Exposure in GiveWP <= 4.16.9 versions. EPSS 0.3%Vulnerability Nexcess #cwe-862	CVE Database V5	2026-09-30
High	7.1	EPSS 0.2%	CVE-2026-96830GiveWP · Cross-site Scripting High7.1EPSS 0.2%2026-09-30CVE Database V5CVE-2026-96830 Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.9 versions. EPSS 0.2%Vulnerability Nexcess #cwe-79	CVE Database V5	2026-09-30
High	7.2	EPSS 0.4%	CVE-2026-94677Kadence WooCommerce Email Designer · Deserialization of Untrusted Data High7.2EPSS 0.4%2026-09-30CVE Database V5CVE-2026-94677 Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions. EPSS 0.4%Vulnerability Nexcess #cwe-502	CVE Database V5	2026-09-30
High	7.1	EPSS 0.2%	CVE-2026-93526Event Tickets · Cross-site Scripting High7.1EPSS 0.2%2026-09-23CVE Database V5CVE-2026-93526 Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.4 versions. EPSS 0.2%Vulnerability Nexcess #cwe-79	CVE Database V5	2026-09-23
Medium	5.3	EPSS 0.2%	CVE-2026-84767BookIt · Insufficient Verification of Data Authenticity Medium5.3EPSS 0.2%2026-09-03CVE Database V5CVE-2026-84767 Unauthenticated Bypass Vulnerability in BookIt <= 2.6.0.3 versions. EPSS 0.2%Vulnerability Nexcess #cwe-345	CVE Database V5	2026-09-03
Critical	9.8	EPSS 0.6%	CVE-2026-78265The Events Calendar · Deserialization of Untrusted Data Critical9.8EPSS 0.6%2026-08-24CVE Database V5CVE-2026-78265 CVE-2026-78265 is a critical vulnerability in Nexcess The Events Calendar plugin, affecting versions up to and including 6.17.2. It involves unauthenticated PHP object injection due to deserialization of untrusted data, classified under CWE-502. This flaw allows an attacker to execute arbitrary code remotely without requiring authentication. EPSS 0.6%Vulnerability Nexcess #cwe-502	CVE Database V5	2026-08-24
High	7.1	EPSS 0.3%	CVE-2026-78263Event Tickets · Cross-site Scripting High7.1EPSS 0.3%2026-08-24CVE Database V5CVE-2026-78263 CVE-2026-78263 is a high-severity unauthenticated cross-site scripting (XSS) vulnerability in Nexcess Event Tickets versions up to and including 5.29.2.1. This vulnerability involves improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts. The vulnerability has a CVSS score of 7.1, indicating significant impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time. EPSS 0.3%Vulnerability Nexcess #cwe-79	CVE Database V5	2026-08-24
High	7.5	EPSS 0.5%	CVE-2026-73997Starter Templates by Kadence WP · Allocation of Resources Without Limits or Throttling High7.5EPSS 0.5%2026-08-18CVE Database V5CVE-2026-73997 Unauthenticated Denial of Service Attack in Starter Templates by Kadence WP <= 2.3.3 versions. EPSS 0.5%Vulnerability Nexcess #cwe-770	CVE Database V5	2026-08-18
Medium	6.5	EPSS 0.3%	CVE-2026-73352GiveWP · Missing Authorization Medium6.5EPSS 0.3%2026-08-18CVE Database V5CVE-2026-73352 Unauthenticated Broken Access Control in GiveWP <= 4.16.5.1 versions. EPSS 0.3%Vulnerability Nexcess #cwe-862	CVE Database V5	2026-08-18
Medium	6.5	EPSS 0.3%	CVE-2026-73348GiveWP · Missing Authorization Medium6.5EPSS 0.3%2026-08-18CVE Database V5CVE-2026-73348 Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions. EPSS 0.3%Vulnerability Nexcess #cwe-862	CVE Database V5	2026-08-18
Medium	6.5	EPSS 0.2%	CVE-2026-73357GiveWP · Cross-site Scripting Medium6.5EPSS 0.2%2026-08-13CVE Database V5CVE-2026-73357 Donor Cross Site Scripting (XSS) in GiveWP < 4.16.6 versions. EPSS 0.2%Vulnerability Nexcess #cwe-79 #ghsa-hmhg-vxc9-cg47	CVE Database V5	2026-08-13
Medium	5.3	EPSS 0.3%	CVE-2026-73349GiveWP · Missing Authorization Medium5.3EPSS 0.3%2026-08-13CVE Database V5CVE-2026-73349 Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions. EPSS 0.3%Vulnerability Nexcess #cwe-862 #ghsa-22r8-gvpx-mqwv	CVE Database V5	2026-08-13
Medium	4.3	EPSS 0.3%	CVE-2026-66696Gutenberg Blocks by Kadence Blocks · Insertion of Sensitive Information Into Sent Data Medium4.3EPSS 0.3%2026-08-06CVE Database V5CVE-2026-66696 CVE-2026-66696 is a medium severity vulnerability in Gutenberg Blocks by Kadence Blocks versions up to and including 3.7.8. It involves the insertion of sensitive information into sent data, classified under CWE-201. The vulnerability allows exposure of contributor sensitive data without requiring user interaction and with low attack complexity. No official patch or remediation guidance is currently available. EPSS 0.3%Vulnerability Nexcess #cwe-201 #ghsa-pfhc-6c7h-5cc4	CVE Database V5	2026-08-06
High	7.1	EPSS 0.3%	CVE-2026-66690GiveWP · Cross-site Scripting High7.1EPSS 0.3%2026-08-06CVE Database V5CVE-2026-66690 CVE-2026-66690 is a high severity unauthenticated cross-site scripting (XSS) vulnerability affecting GiveWP versions up to and including 4.16.5. This vulnerability allows an attacker to inject malicious scripts during web page generation without requiring authentication. The vulnerability is categorized under CWE-79, indicating improper neutralization of input. No official patch or remediation guidance is currently provided by the vendor, and no known exploits are reported in the wild. EPSS 0.3%Vulnerability Nexcess #cwe-79 #ghsa-q64f-8jfv-6r69	CVE Database V5	2026-08-06

Showing 1–20 of 28 results · 1 duplicate CVE record merged