[ Vendor · 9 CVEs ]
Nexcess
CVEs affecting Nexcess published in the last 30 days, plus any Nexcess CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-104405 | 6 Oct 2026 | CVSS 8.1 | Nexcess GiveWPUnauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions. | |
| CVE-2026-104672 | 6 Oct 2026 | CVSS 7.1 | Nexcess GiveWPUnauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions. | |
| CVE-2026-97285 | 30 Sep 2026 | CVSS 5.4 | Nexcess The Events CalendarContributor Broken Access Control in The Events Calendar <= 6.17.5 versions. | |
| CVE-2026-97266 | 30 Sep 2026 | CVSS 6.5 | Nexcess Virtue/Ascend/Pinnacle ToolkitContributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12.1 versions. | |
| CVE-2026-97066 | 30 Sep 2026 | CVSS 5.3 | Nexcess GiveWPUnauthenticated Insecure Direct Object References (IDOR) in GiveWP <= 4.16.9 versions. | |
| CVE-2026-96834 | 30 Sep 2026 | CVSS 6.5 | Nexcess GiveWPSubscriber Sensitive Data Exposure in GiveWP <= 4.16.9 versions. | |
| CVE-2026-96830 | 30 Sep 2026 | CVSS 7.1 | Nexcess GiveWPUnauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.9 versions. | |
| CVE-2026-94677 | 30 Sep 2026 | CVSS 7.2 | Nexcess Kadence WooCommerce Email DesignerShop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions. | |
| CVE-2026-93526 | 23 Sep 2026 | CVSS 7.1 | Nexcess Event TicketsUnauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.4 versions. |