Nexcess has 10 CVEs on record. Disclosure cadence is accelerating: 10 in the last 90 days against 0 in the 90 before. The busiest recent month was September 2026 with 8. The median CVSS is 7.1 (high). None have a confirmed exploitation report. The most common weakness class is CWE-79 (4). Most affected products: give (5), event-tickets (2), kadence-woocommerce-email-designer (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.1
- Publish → KEV
- —
- Last 90 days
- 10 prev 0
Products
- give 5
- event-tickets 2
- kadence-woocommerce-email-designer 1
- the-events-calendar 1
- virtue-toolkit 1
Worst active — by depth score
CVE-2026-97287High· 8.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Blind SQL Injection. This issue affects Event Tickets: from n/a through 5.29.5.47CVE-2026-104405High· 8.1Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions.45CVE-2026-94677High· 7.2Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions.40CVE-2026-104672High· 7.1Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions.39CVE-2026-96830High· 7.1Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.9 versions.39
Nexcess vulnerabilities
CVEs affecting Nexcess, newest first. Open any entry for full detail, references, and exploit status.
10 CVEsRSS
CVE-2026-104405High· 8.1Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions.
Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions.
CVE-2026-104672High· 7.1Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions.
Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions.
CVE-2026-94677High· 7.2Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions.
Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions.
CVE-2026-96830High· 7.1Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.9 versions.
Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.9 versions.
CVE-2026-96834Medium· 6.5Subscriber Sensitive Data Exposure in GiveWP <= 4.16.9 versions.
Subscriber Sensitive Data Exposure in GiveWP <= 4.16.9 versions.
CVE-2026-97066Medium· 5.3Unauthenticated Insecure Direct Object References (IDOR) in GiveWP <= 4.16.9 versions.
Unauthenticated Insecure Direct Object References (IDOR) in GiveWP <= 4.16.9 versions.
CVE-2026-97266Medium· 6.5Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12.1 versions.
Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12.1 versions.
CVE-2026-97285Medium· 5.4Contributor Broken Access Control in The Events Calendar <= 6.17.5 versions.
Contributor Broken Access Control in The Events Calendar <= 6.17.5 versions.
CVE-2026-97287High· 8.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Blind SQL Injection. This issue affects Event Tickets: from n/a through 5.29.5.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Blind SQL Injection. This issue affects Event Tickets: from n/a through 5.29.5.
CVE-2026-93526High· 7.1Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.4 versions.
Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.4 versions.