Liquid Web Stellarwp

CVE	Summary	Severity	CVSS	EPSS	Priority	Signals
CVE-2026-82222	Unauthenticated PHP object injection in the GiveWP WordPress donation plugin (all versions through 4.16.7.1) lets remote attackers reach a deserialization sink and chain it into remote code execution on the hosting server. The flaw is network-reachable with no authentication or user interaction and carries a maximum CVSS of 10.0; Patchstack's public write-up details the full object-injection-to-RCE chain, though no in-the-wild exploitation has been confirmed. Because GiveWP handles donation and payment workflows, a successful attack fully compromises the site and any donor data it processes.	CRITICAL	10.0	0.4%	70	PoC No patch
CVE-2026-97283	Object injection in the WordPress plugin Advanced Post Manager (all releases through version 4.5.5) lets remote attackers push attacker-controlled serialized data into PHP's unserialize() routine, potentially instantiating arbitrary objects and, where a usable POP gadget chain exists, achieving code execution with full confidentiality, integrity and availability impact. The NVD vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) treats the flaw as unauthenticated and network-reachable, whereas our independent assessment raises attack complexity to High because real-world impact hinges on a reachable gadget chain in the plugin, WordPress core or another active plugin; no public exploit identified at time of analysis and there is no CISA KEV entry for this CVE.	CRITICAL	9.8	0.4%	49	No patch
CVE-2026-95606	PHP object injection in The Events Calendar WordPress plugin (all versions through 6.17.4, published by Liquid Web / StellarWP) allows an attacker to pass crafted serialized data into a deserialization code path and instantiate arbitrary PHP objects, which can escalate to code execution, data theft or full site compromise if a usable POP gadget chain exists in the plugin, WordPress core or any other installed theme/plugin. The supplied CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) describes a remote, unauthenticated, no-interaction attack, but the advisory does not name the vulnerable endpoint, and comparable Patchstack object-injection findings frequently require at least a low-privilege authenticated session; our independent assessment therefore keeps the same impact ratings while treating exploitability as high-complexity (AC:H). There is no CISA KEV listing and no public exploit identified at time of analysis, so the practical risk is driven by whether a reachable gadget chain is present on a given WordPress installation rather than by confirmed active exploitation.	CRITICAL	9.8	0.3%	49	No patch
CVE-2026-96333	Payment bypass in GiveWP WordPress plugin through 4.16.8.1 allows unauthenticated remote attackers to have donations accepted without a legitimately cleared payment. This CWE-290 spoofing flaw has a CVSS score of 7.5, but impact is limited to donation/transaction integrity; it does not grant WordPress authentication, admin access, or server control. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, and EPSS data is not provided.	HIGH	7.5	0.3%	38	No patch
CVE-2026-66599	Unauthenticated cross-site scripting in the WPComplete WordPress plugin (versions up to and including 2.9.5.6) allows remote attackers to inject and execute arbitrary JavaScript in the context of another user's browser session, with scope change indicating the payload crosses the plugin's security boundary to affect authenticated users such as site administrators. The CVSS vector (PR:N/UI:R/S:C) is consistent with a stored or reflected XSS pattern where an unauthenticated attacker plants a payload that is later triggered when a privileged user visits an affected page. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.	HIGH	7.1	0.1%	36	No patch
CVE-2026-103354	Stored cross-site scripting in the Kadence Blocks WordPress plugin (Gutenberg Blocks by Kadence Blocks, versions from n/a through 3.7.11.1) allows a low-privileged content author to persist malicious script inside a Kadence/Gutenberg block, which then executes in the browser of any user who views the affected page or post - including an administrator. Patchstack rates it CVSS 7.1 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L; the independent assessment refines this to AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, because reaching the vulnerable editing surface realistically requires an account with post/page authoring capability, and no public exploit code has been identified at time of analysis. Impact is bounded to script execution in the victim's browser (session theft, admin-side actions via the victim's session, defacement) rather than direct server compromise, and it depends on the plugin being installed and active.	HIGH	7.1	0.1%	36	No patch
CVE-2026-66479	Stored cross-site scripting can be planted on WordPress sites running the WPComplete plugin through version 2.9.5.6, because a WPComplete write action is performed without adequate CSRF nonce validation (CWE-352) and the stored value is later rendered without sufficient output encoding. Per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) the attacker needs no credentials of their own, but exploitation requires tricking a logged-in, privileged WordPress user into visiting an attacker-controlled page or link while their session is active, which is the primary limiting factor. No public exploit code or confirmed active exploitation was identified at time of analysis, and the net effect is a moderate-priority risk: injected script executes in the site context (scope changed) and can affect other users, but impact to confidentiality, integrity, and availability is each rated Low.	HIGH	7.1	0.1%	36	No patch
CVE-2026-111396	Missing authorization checks in the Advanced Post Manager WordPress plugin through version 4.5.6 let an authenticated user invoke functionality that should be reserved for higher-privileged roles, weakening the site's access-control boundary. Exploitation requires a valid low-privileged session (CVSS PR:L), so realistic exposure exists mainly on sites with open registration or attacker-controlled accounts, and no public exploit code has been identified at time of analysis. The demonstrated impact is limited to integrity and availability (C:N/I:L/A:L per our assessment), which is why this reads as a moderate-priority issue rather than a top-tier emergency.	HIGH	7.1	0.2%	36	No patch
CVE-2026-104404	Stored cross-site scripting in the GiveWP WordPress donation plugin (versions through 4.17.0) lets an authenticated user with only low-level privileges persist a script payload that executes in the browser of any user who later views the affected page. Because the injected code runs in the origin of the WordPress site (CVSS scope change: S:C), an attacker who convinces an administrator to open the poisoned screen can steal session cookies, harvest nonces, or perform privileged actions as that administrator. A vendor/Patchstack CVSS 3.1 base score of 6.5 (Medium) applies, exploitation requires an authenticated account plus victim interaction, and no public exploit code or confirmed active exploitation was identified at time of analysis.	MEDIUM	6.5	0.2%	33	No patch
CVE-2026-110903	Stored cross-site scripting in the WordPress plugin The Events Calendar (versions through 6.18.1) lets an authenticated attacker with event-authoring privileges inject persistent JavaScript that executes when another user, such as an administrator, views the affected event page. Exploitation requires a low-privilege WordPress account (PR:L) and victim interaction (UI:R), and the flaw carries a CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). No public exploit has been identified at time of analysis, and the issue was reported by Patchstack.	MEDIUM	6.5	0.1%	32	No patch
CVE-2026-115602	Stored cross-site scripting in the WordPress plugin Gutenberg Blocks by Kadence Blocks (versions through 3.8.0.1) lets a low-privileged authenticated user persist script-bearing content that executes in another user's browser when that content is rendered. Per the assessed vector (CVSS 6.5, AV:L/AC:L/PR:L/UI:R/S:C), an attacker must already hold a content-contributing account such as contributor or author, and impact only materializes when a separate victim - typically a higher-privileged user viewing the affected page - loads the injected content. The issue was reported by Patchstack and is scheduled for this-month remediation priority; no public exploit code or active exploitation (CISA KEV) is associated with it at time of analysis, though successful exploitation crosses a privilege boundary (scope change) and can yield limited confidentiality, integrity and availability effects.	MEDIUM	6.5	0.2%	32	No patch
CVE-2026-106600	GiveWP, a WordPress donation and fundraising plugin, ships with a missing-authorization flaw (CWE-862) in versions through 4.18.0 that allows remote attackers to perform unauthorized actions against plugin-scoped data without authenticating or interacting with a victim. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3) confines impact to a limited integrity loss with no confidentiality or availability effect, so the realistic outcome is unauthorized modification of donation-related or plugin configuration data rather than full site compromise. Any internet-reachable WordPress installation running the affected range is exposed by default; no public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is tracked by Patchstack and as EUVD-2026-94928.	MEDIUM	5.3	0.2%	26	No patch
CVE-2026-110900	Missing authorization in the BookIt WordPress plugin (Liquid Web / StellarWP), in all versions through 2.6.0.5, allows remote unauthenticated attackers to reach a protected plugin action that should be restricted to privileged users, resulting in unauthorized modification of site data. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3) confirms exploitation is network-based, unauthenticated, low complexity and requires no user interaction, but impact is confined to integrity - there is no confidentiality or availability loss and no scope change, so this is a moderate-priority broken access control issue rather than a full site takeover. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the exact endpoint or feature lacking the capability check is not specified in the available description and should be confirmed against the Patchstack advisory.	MEDIUM	5.3	0.2%	26	No patch
CVE-2026-104675	Missing authorization checks in the WordPress Event Tickets plugin from Liquid Web / StellarWP (versions through 5.30.0) allow an authenticated low-privilege user to carry out restricted ticket-related actions they should not be permitted to perform, resulting in limited integrity impact with no data disclosure or denial of service. As confirmed by the CVSS vector (PR:L), exploitation requires a valid account on the target site at a low privilege level - typically a self-registered subscriber, customer, or event attendee - so sites that allow open user registration carry more exposure than those with registration closed. No public exploit code has been identified at time of analysis and the issue is not reported as actively exploited; the assessed severity is low (CVSS 4.3), making this a genuine-but-low-priority hardening item rather than an emergency patch.	MEDIUM	4.3	0.2%	22	No patch
CVE-2026-110902	Authorization bypass in the WordPress Event Tickets plugin (all versions through 5.30.1) lets an authenticated user tamper with user-controlled object keys and reach ticketing records that should belong to another attendee, customer, or event. Because exploitation requires a valid logged-in account (CVSS PR:L), the realistic exposure is limited to sites that permit self-registration or that automatically issue accounts to attendees and customers; the impact stays within unauthorized read/modification of ticketing objects (I:L, no confidentiality or availability effect), giving a moderate vendor score of 4.3. No public exploit code has been identified at time of analysis and the issue has not been added to CISA KEV.	MEDIUM	4.3	0.2%	22	No patch

CVE-2026-82222

Unauthenticated PHP object injection in the GiveWP WordPress donation plugin (all versions through 4.16.7.1) lets remote attackers reach a deserialization sink and chain it into remote code execution on the hosting server. The flaw is network-reachable with no authentication or user interaction and carries a maximum CVSS of 10.0; Patchstack's public write-up details the full object-injection-to-RCE chain, though no in-the-wild exploitation has been confirmed. Because GiveWP handles donation and payment workflows, a successful attack fully compromises the site and any donor data it processes.

CRITICAL

10.0

0.4%

70

PoC No patch

CVE-2026-97283

Object injection in the WordPress plugin Advanced Post Manager (all releases through version 4.5.5) lets remote attackers push attacker-controlled serialized data into PHP's unserialize() routine, potentially instantiating arbitrary objects and, where a usable POP gadget chain exists, achieving code execution with full confidentiality, integrity and availability impact. The NVD vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) treats the flaw as unauthenticated and network-reachable, whereas our independent assessment raises attack complexity to High because real-world impact hinges on a reachable gadget chain in the plugin, WordPress core or another active plugin; no public exploit identified at time of analysis and there is no CISA KEV entry for this CVE.

CRITICAL

9.8

0.4%

49

No patch

CVE-2026-95606

PHP object injection in The Events Calendar WordPress plugin (all versions through 6.17.4, published by Liquid Web / StellarWP) allows an attacker to pass crafted serialized data into a deserialization code path and instantiate arbitrary PHP objects, which can escalate to code execution, data theft or full site compromise if a usable POP gadget chain exists in the plugin, WordPress core or any other installed theme/plugin. The supplied CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) describes a remote, unauthenticated, no-interaction attack, but the advisory does not name the vulnerable endpoint, and comparable Patchstack object-injection findings frequently require at least a low-privilege authenticated session; our independent assessment therefore keeps the same impact ratings while treating exploitability as high-complexity (AC:H). There is no CISA KEV listing and no public exploit identified at time of analysis, so the practical risk is driven by whether a reachable gadget chain is present on a given WordPress installation rather than by confirmed active exploitation.

CRITICAL

9.8

0.3%

49

No patch

CVE-2026-96333

Payment bypass in GiveWP WordPress plugin through 4.16.8.1 allows unauthenticated remote attackers to have donations accepted without a legitimately cleared payment. This CWE-290 spoofing flaw has a CVSS score of 7.5, but impact is limited to donation/transaction integrity; it does not grant WordPress authentication, admin access, or server control. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, and EPSS data is not provided.

HIGH

7.5

0.3%

38

No patch

CVE-2026-66599

Unauthenticated cross-site scripting in the WPComplete WordPress plugin (versions up to and including 2.9.5.6) allows remote attackers to inject and execute arbitrary JavaScript in the context of another user's browser session, with scope change indicating the payload crosses the plugin's security boundary to affect authenticated users such as site administrators. The CVSS vector (PR:N/UI:R/S:C) is consistent with a stored or reflected XSS pattern where an unauthenticated attacker plants a payload that is later triggered when a privileged user visits an affected page. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

HIGH

7.1

0.1%

36

No patch

CVE-2026-103354

Stored cross-site scripting in the Kadence Blocks WordPress plugin (Gutenberg Blocks by Kadence Blocks, versions from n/a through 3.7.11.1) allows a low-privileged content author to persist malicious script inside a Kadence/Gutenberg block, which then executes in the browser of any user who views the affected page or post - including an administrator. Patchstack rates it CVSS 7.1 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L; the independent assessment refines this to AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, because reaching the vulnerable editing surface realistically requires an account with post/page authoring capability, and no public exploit code has been identified at time of analysis. Impact is bounded to script execution in the victim's browser (session theft, admin-side actions via the victim's session, defacement) rather than direct server compromise, and it depends on the plugin being installed and active.

HIGH

7.1

0.1%

36

No patch

CVE-2026-66479

Stored cross-site scripting can be planted on WordPress sites running the WPComplete plugin through version 2.9.5.6, because a WPComplete write action is performed without adequate CSRF nonce validation (CWE-352) and the stored value is later rendered without sufficient output encoding. Per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) the attacker needs no credentials of their own, but exploitation requires tricking a logged-in, privileged WordPress user into visiting an attacker-controlled page or link while their session is active, which is the primary limiting factor. No public exploit code or confirmed active exploitation was identified at time of analysis, and the net effect is a moderate-priority risk: injected script executes in the site context (scope changed) and can affect other users, but impact to confidentiality, integrity, and availability is each rated Low.

HIGH

7.1

0.1%

36

No patch

CVE-2026-111396

Missing authorization checks in the Advanced Post Manager WordPress plugin through version 4.5.6 let an authenticated user invoke functionality that should be reserved for higher-privileged roles, weakening the site's access-control boundary. Exploitation requires a valid low-privileged session (CVSS PR:L), so realistic exposure exists mainly on sites with open registration or attacker-controlled accounts, and no public exploit code has been identified at time of analysis. The demonstrated impact is limited to integrity and availability (C:N/I:L/A:L per our assessment), which is why this reads as a moderate-priority issue rather than a top-tier emergency.

HIGH

7.1

0.2%

36

No patch

CVE-2026-104404

Stored cross-site scripting in the GiveWP WordPress donation plugin (versions through 4.17.0) lets an authenticated user with only low-level privileges persist a script payload that executes in the browser of any user who later views the affected page. Because the injected code runs in the origin of the WordPress site (CVSS scope change: S:C), an attacker who convinces an administrator to open the poisoned screen can steal session cookies, harvest nonces, or perform privileged actions as that administrator. A vendor/Patchstack CVSS 3.1 base score of 6.5 (Medium) applies, exploitation requires an authenticated account plus victim interaction, and no public exploit code or confirmed active exploitation was identified at time of analysis.

MEDIUM

6.5

0.2%

33

No patch

CVE-2026-110903

Stored cross-site scripting in the WordPress plugin The Events Calendar (versions through 6.18.1) lets an authenticated attacker with event-authoring privileges inject persistent JavaScript that executes when another user, such as an administrator, views the affected event page. Exploitation requires a low-privilege WordPress account (PR:L) and victim interaction (UI:R), and the flaw carries a CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). No public exploit has been identified at time of analysis, and the issue was reported by Patchstack.

MEDIUM

6.5

0.1%

32

No patch

CVE-2026-115602

Stored cross-site scripting in the WordPress plugin Gutenberg Blocks by Kadence Blocks (versions through 3.8.0.1) lets a low-privileged authenticated user persist script-bearing content that executes in another user's browser when that content is rendered. Per the assessed vector (CVSS 6.5, AV:L/AC:L/PR:L/UI:R/S:C), an attacker must already hold a content-contributing account such as contributor or author, and impact only materializes when a separate victim - typically a higher-privileged user viewing the affected page - loads the injected content. The issue was reported by Patchstack and is scheduled for this-month remediation priority; no public exploit code or active exploitation (CISA KEV) is associated with it at time of analysis, though successful exploitation crosses a privilege boundary (scope change) and can yield limited confidentiality, integrity and availability effects.

MEDIUM

6.5

0.2%

32

No patch

CVE-2026-106600

GiveWP, a WordPress donation and fundraising plugin, ships with a missing-authorization flaw (CWE-862) in versions through 4.18.0 that allows remote attackers to perform unauthorized actions against plugin-scoped data without authenticating or interacting with a victim. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3) confines impact to a limited integrity loss with no confidentiality or availability effect, so the realistic outcome is unauthorized modification of donation-related or plugin configuration data rather than full site compromise. Any internet-reachable WordPress installation running the affected range is exposed by default; no public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is tracked by Patchstack and as EUVD-2026-94928.

MEDIUM

5.3

0.2%

26

No patch

CVE-2026-110900

Missing authorization in the BookIt WordPress plugin (Liquid Web / StellarWP), in all versions through 2.6.0.5, allows remote unauthenticated attackers to reach a protected plugin action that should be restricted to privileged users, resulting in unauthorized modification of site data. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3) confirms exploitation is network-based, unauthenticated, low complexity and requires no user interaction, but impact is confined to integrity - there is no confidentiality or availability loss and no scope change, so this is a moderate-priority broken access control issue rather than a full site takeover. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the exact endpoint or feature lacking the capability check is not specified in the available description and should be confirmed against the Patchstack advisory.

MEDIUM

5.3

0.2%

26

No patch

CVE-2026-104675

Missing authorization checks in the WordPress Event Tickets plugin from Liquid Web / StellarWP (versions through 5.30.0) allow an authenticated low-privilege user to carry out restricted ticket-related actions they should not be permitted to perform, resulting in limited integrity impact with no data disclosure or denial of service. As confirmed by the CVSS vector (PR:L), exploitation requires a valid account on the target site at a low privilege level - typically a self-registered subscriber, customer, or event attendee - so sites that allow open user registration carry more exposure than those with registration closed. No public exploit code has been identified at time of analysis and the issue is not reported as actively exploited; the assessed severity is low (CVSS 4.3), making this a genuine-but-low-priority hardening item rather than an emergency patch.

MEDIUM

4.3

0.2%

22

No patch

CVE-2026-110902

Authorization bypass in the WordPress Event Tickets plugin (all versions through 5.30.1) lets an authenticated user tamper with user-controlled object keys and reach ticketing records that should belong to another attendee, customer, or event. Because exploitation requires a valid logged-in account (CVSS PR:L), the realistic exposure is limited to sites that permit self-registration or that automatically issue accounts to attendees and customers; the impact stays within unauthorized read/modification of ticketing objects (I:L, no confidentiality or availability effect), giving a moderate vendor score of 4.3. No public exploit code has been identified at time of analysis and the issue has not been added to CISA KEV.

MEDIUM

4.3

0.2%

22

No patch

Severity Breakdown

Monthly CVE Trend

Affected Products (8)

Top Risky CVEs