Nexcess
Vulnerability activity for Nexcess: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 1
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 11
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 12
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 6.5MediumOct 30, 2026Nexcess GiveWP Auth bypass / access controlCVE-2026-116853Unauthenticated Broken Access Control in GiveWP <= 4.19.0.1 versions.
- 7.1HighOct 6, 2026Nexcess GiveWP XSSCVE-2026-104672Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions.
- 8.1HighOct 6, 2026Nexcess GiveWP Privilege escalationCVE-2026-104405Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions.
- 5.4MediumSep 30, 2026Nexcess The Events Calendar Auth bypass / access controlCVE-2026-97285Contributor Broken Access Control in The Events Calendar <= 6.17.5 versions.
- 6.5MediumSep 30, 2026Nexcess Virtue/Ascend/Pinnacle Toolkit XSSCVE-2026-97266Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12.1 versions.
- 5.3MediumSep 30, 2026Nexcess GiveWP Auth bypass / access controlCVE-2026-97066Unauthenticated Insecure Direct Object References (IDOR) in GiveWP <= 4.16.9 versions.
- 6.5MediumSep 30, 2026Nexcess GiveWP Auth bypass / access controlCVE-2026-96834Subscriber Sensitive Data Exposure in GiveWP <= 4.16.9 versions.
- 7.1HighSep 30, 2026Nexcess GiveWP XSSCVE-2026-96830Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.9 versions.
- 7.2HighSep 30, 2026Nexcess Kadence WooCommerce Email Designer DeserializationCVE-2026-94677Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions.
- 7.1HighSep 23, 2026Nexcess Event Tickets XSSCVE-2026-93526Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.4 versions.
- 5.3MediumSep 3, 2026Nexcess BookIt Auth bypass / access controlCVE-2026-84767Unauthenticated Bypass Vulnerability in BookIt <= 2.6.0.3 versions.
- 5.4MediumJun 26, 2026Nexcess WPComplete Auth bypass / access controlCVE-2026-57661Subscriber Broken Access Control in WPComplete <= 2.9.5.5 versions.
Top products
- GiveWP6 CVEs in the last year
- WPComplete1 CVE in the last year
- Virtue/Ascend/Pinnacle Toolkit1 CVE in the last year
- The Events Calendar1 CVE in the last year
- Kadence WooCommerce Email Designer1 CVE in the last year
- Event Tickets1 CVE in the last year
- BookIt1 CVE in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.