Threat database

Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.1.

Missing Authorization vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Post Manager: from n/a through 4.5.6.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Stored XSS.This issue affects The Events Calendar: from n/a through 6.18.1.

CVE-2026-110900 is a missing authorization vulnerability in Liquid Web / StellarWP BookIt plugin versions before 2.6.0.6. It allows unauthorized users to exploit incorrectly configured access control security levels, potentially leading to unauthorized modification of data. The vulnerability has a medium severity with a CVSS score of 5.3. No known exploits are reported in the wild, and no official patch information is provided in the available data.

A stored cross-site scripting (XSS) vulnerability exists in the GiveWP – Donation Plugin and Fundraising Platform for WordPress, affecting versions up to and including 4.17.0. The flaw arises from insufficient sanitization and escaping of user-supplied shortcode attributes, allowing authenticated users with Contributor-level access or higher to inject malicious scripts. These scripts execute whenever a user views the affected page, potentially compromising user interactions.

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor WordPress plugin is affected by a stored cross-site scripting (XSS) vulnerability in versions up to and including 3.7.12. This vulnerability arises from improper input sanitization and output escaping of the Block Font Family attribute. It can be exploited by authenticated users with author-level access or higher to inject malicious scripts that execute when other users view the affected pages. The vulnerability is only triggered if the 'Load Google Fonts Locally' option is enabled, which is not the default setting.

Authentication Bypass by Spoofing vulnerability in Liquid Web / StellarWP GiveWP give allows Identity Spoofing.This issue affects GiveWP: from n/a through 4.16.8.1.

Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Manipulating User-Controlled Variables.This issue affects Event Tickets: from n/a through 5.30.0.1.

CVE-2026-105891 is a missing authorization vulnerability in the Liquid Web / StellarWP Event Tickets plugin. It allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized actions. The issue affects versions from initial releases up to 5.30.0.1. The vulnerability has a medium severity rating with a CVSS score of 4.3.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.7.12.

Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.0.1.

Cross-Site Request Forgery (CSRF) vulnerability in Liquid Web / StellarWP WPComplete wpcomplete allows Stored XSS.This issue affects WPComplete: from n/a through 2.9.5.6.

Missing Authorization vulnerability in Liquid Web / StellarWP GiveWP give allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GiveWP: from n/a through 4.18.0.

Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP The Events Calendar allows Object Injection. This issue affects The Events Calendar: from n/a through 6.17.4.

CVE-2026-97283 is a critical deserialization of untrusted data vulnerability in Liquid Web / StellarWP Advanced Post Manager. It allows object injection, potentially leading to full system compromise. The issue affects all versions from initial release up to 4.5.5 inclusive. The vulnerability has a high CVSS score of 9.8, indicating critical impact on confidentiality, integrity, and availability. No official patch or vendor advisory is provided in the input data. No known exploits are reported in the wild.

Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.0.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP GiveWP give allows Stored XSS.This issue affects GiveWP: from n/a through 4.17.0.

CVE-2026-103354 is a stored cross-site scripting (XSS) vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks. It affects versions up to and including 3.7.11.1. The flaw involves improper neutralization of input during web page generation, which could allow attackers to inject malicious scripts. The vulnerability has a high severity rating with a CVSS score of 7.1.

The Event Tickets and Registration plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 5.29.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. A Contributor-level user can reach the vulnerable code path by supplying a post_id they authored, as the can_access_page() gate requires only post authorship rather than the edit_others_posts capability for post owners.