Stellarwp vulnerabilities

Products

• Givewp 49
• Givewp – Donation Plugin And Fundraising Platform 45
• The Events Calendar 42
• Kadence Blocks — Page Builder Toolkit For Gutenberg Editor 30
• Event Tickets 17
• Learndash Lms 10
• The Events Calendar 9
• Wpcomplete 9
• Event Tickets And Registration 8
• Kadence Woocommerce Email Designer 7
• Membership Plugin – Restrict Content 7
• Bookit — Booking & Appointment Calendar 6
• Gutenberg Blocks By Kadence Blocks 3
• Image Widget 2
• Restrict Content 2

Newest

• nexcess givewp WordPress GiveWP plugin <= 4.19.0.1 - Broken Access Control vulnerability CVE-2026-116853 6.5 MediumOctober 30, 2026
• liquid web / stellarwp event tickets WordPress Event Tickets plugin <= 5.30.2 - Broken Access Control vulnerability CVE-2026-62047 4.3 MediumOctober 30, 2026
• liquid web / stellarwp event tickets WordPress Event Tickets plugin <= 5.30.2 - Broken Access Control vulnerability CVE-2026-62055 4.3 MediumOctober 30, 2026
• liquid web / stellarwp the events calendar WordPress The Events Calendar plugin <= 6.18.2 - Broken Access Control vulnerability CVE-2026-119367 5.4 MediumOctober 30, 2026
• liquid web / stellarwp the events calendar WordPress The Events Calendar plugin <= 6.18.2 - Cross Site Scripting (XSS) vulnerability CVE-2026-119369 6.5 MediumOctober 30, 2026
• liquid web / stellarwp the events calendar WordPress The Events Calendar plugin <= 6.18.2 - Broken Access Control vulnerability CVE-2026-119368 5.3 MediumOctober 30, 2026
• liquid web / stellarwp the events calendar WordPress The Events Calendar plugin <= 6.18.2 - Cross Site Scripting (XSS) vulnerability CVE-2026-119370 6.5 MediumOctober 30, 2026
• stellarwp givewp GiveWP < 4.19.0.1 - Unauthenticated Donation Amount Restriction Bypass via Currency CVE-2026-111974 5.3 MediumOctober 26, 2026
• stellarwp givewp GiveWP < 4.19.0.1 - Authenticated Arbitrary Donor Address Modification via donor_manage_addresses CVE-2026-111981 2.7 LowOctober 25, 2026
• stellarwp givewp GiveWP < 4.19.0.1 - Give Worker+ Arbitrary Page Modification via Campaign Page Capability Grant CVE-2026-111980 5.5 MediumOctober 25, 2026
• stellarwp givewp GiveWP < 4.19.0.1 - Give Worker+ Stored XSS via Form Template Primary Color CVE-2026-111979 6.8 MediumOctober 25, 2026
• stellarwp givewp GiveWP < 4.19.0.1 - Give Manager+ Path Traversal via Core Settings Import CVE-2026-111978 6.0 MediumOctober 25, 2026
• stellarwp givewp GiveWP < 4.19.0.1 - Unauthenticated Unpublished Donation Form Disclosure via Form View Route CVE-2026-111976 5.3 MediumOctober 25, 2026
• liquid web / stellarwp event tickets WordPress Event Tickets plugin <= 5.30.1 - Insecure Direct Object References (IDOR) vulnerability CVE-2026-110902 4.3 MediumOctober 19, 2026
• liquid web / stellarwp the events calendar WordPress The Events Calendar plugin <= 6.18.1 - Cross Site Scripting (XSS) vulnerability CVE-2026-110903 6.5 MediumOctober 16, 2026
• stellarwp givewp – donation plugin and fundraising platform GiveWP <= 4.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via givewp_campaign_grid Shortcode Attributes CVE-2026-97643 6.4 MediumOctober 10, 2026
• stellarwp kadence blocks — page builder toolkit for gutenberg editor Kadence Blocks <= 3.7.12 - Authenticated (Author+) Stored Cross-Site Scripting via Block Font Family Attribute CVE-2026-104762 6.4 MediumOctober 10, 2026
• liquid web / stellarwp givewp WordPress GiveWP plugin <= 4.16.8.1 - Payment Bypass vulnerability CVE-2026-96333 7.5 HighOctober 9, 2026
• liquid web / stellarwp event tickets WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability CVE-2026-105893 5.3 MediumOctober 8, 2026
• liquid web / stellarwp event tickets WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability CVE-2026-105891 4.3 MediumOctober 8, 2026
• liquid web / stellarwp event tickets WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability CVE-2026-105888 5.4 MediumOctober 8, 2026
• liquid web / stellarwp wpcomplete WordPress WPComplete plugin <= 2.9.5.6 - CSRF to Stored XSS vulnerability CVE-2026-66479 7.1 HighOctober 8, 2026
• liquid web / stellarwp givewp WordPress GiveWP plugin <= 4.18.0 - Broken Access Control vulnerability CVE-2026-106600 5.3 MediumOctober 8, 2026
• liquid web / stellarwp the events calendar WordPress The Events Calendar plugin <= 6.17.4 - PHP Object Injection vulnerability CVE-2026-95606 9.8 CriticalOctober 7, 2026
• nexcess givewp WordPress GiveWP plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability CVE-2026-104672 7.1 HighOctober 6, 2026
• nexcess givewp WordPress GiveWP plugin <= 4.17.0 - Privilege Escalation vulnerability CVE-2026-104405 8.1 HighOctober 6, 2026
• liquid web / stellarwp event tickets WordPress Event Tickets plugin <= 5.30.0 - Broken Access Control vulnerability CVE-2026-104675 4.3 MediumOctober 5, 2026
• liquid web / stellarwp givewp WordPress GiveWP plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability CVE-2026-104404 6.5 MediumOctober 5, 2026
• stellarwp event tickets and registration Event Tickets and Registration <= 5.29.5 - Authenticated (Contributor+) SQL Injection via 'orderby' Parameter CVE-2026-97634 6.5 MediumOctober 2, 2026
• stellarwp the events calendar The Events Calendar 6.12.0 - 6.17.5 - Unauthenticated Arbitrary Shortcode Execution via 'view_data' Parameter CVE-2026-84740 6.5 MediumOctober 2, 2026
• liquid web / stellarwp event tickets WordPress Event Tickets plugin <= 5.29.5 - SQL Injection vulnerability CVE-2026-97287 8.5 HighSeptember 30, 2026
• nexcess the events calendar WordPress The Events Calendar plugin <= 6.17.5 - Broken Access Control vulnerability CVE-2026-97285 5.4 MediumSeptember 30, 2026
• nexcess givewp WordPress GiveWP plugin <= 4.16.9 - Insecure Direct Object References (IDOR) vulnerability CVE-2026-97066 5.3 MediumSeptember 30, 2026
• nexcess givewp WordPress GiveWP plugin <= 4.16.9 - Sensitive Data Exposure vulnerability CVE-2026-96834 6.5 MediumSeptember 30, 2026
• nexcess givewp WordPress GiveWP plugin <= 4.16.9 - Cross Site Scripting (XSS) vulnerability CVE-2026-96830 7.1 HighSeptember 30, 2026
• nexcess kadence woocommerce email designer WordPress Kadence WooCommerce Email Designer plugin <= 1.5.19.1 - PHP Object Injection vulnerability CVE-2026-94677 7.2 HighSeptember 30, 2026
• liquid web / stellarwp givewp WordPress GiveWP plugin <= 4.16.9 - Broken Authentication vulnerability CVE-2026-97196 9.1 CriticalSeptember 30, 2026
• nexcess event tickets WordPress Event Tickets plugin <= 5.29.4 - Cross Site Scripting (XSS) vulnerability CVE-2026-93526 7.1 HighSeptember 23, 2026
• stellarwp the events calendar The Events Calendar 6.15.16.1 - 6.17.4.1 - Contributor+ Event/Venue/Organizer Update, Trash and Ownership Takeover via by-slug REST Routes CVE-2026-84743 3.8 LowSeptember 23, 2026
• stellarwp the events calendar The Events Calendar 6.15.0 - 6.17.4.1 - Contributor+ Content Publication via TEC V1 REST API CVE-2026-84742 2.7 LowSeptember 23, 2026
• stellarwp the events calendar The Events Calendar 4.5 - 6.17.4.1 - Unauthenticated Non-Public Venue and Organizer Disclosure via REST API CVE-2026-84741 5.3 MediumSeptember 23, 2026
• stellarwp givewp GiveWP < 4.16.9 - Unauthenticated Arbitrary Shortcode Execution via Donor Name CVE-2026-85113 6.5 MediumSeptember 21, 2026
• stellarwp wpcomplete WPComplete <= 2.9.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'empty' Shortcode Attribute CVE-2026-77820 6.4 MediumSeptember 19, 2026
• stellarwp bookit — booking & appointment calendar Bookit < 2.6.0.5 - Bookit Staff+ Appointment PII Disclosure CVE-2026-89008 2.7 LowSeptember 18, 2026
• stellarwp bookit — booking & appointment calendar Bookit < 2.6.0.5 - Bookit Staff+ Arbitrary Appointment Deletion via Missing Authorization CVE-2026-89007 2.7 LowSeptember 18, 2026
• stellarwp givewp GiveWP < 4.16.8.1 - Unauthenticated Account Takeover via Donor Email Sanitization Mismatch CVE-2026-85530 8.1 HighSeptember 16, 2026
• stellarwp bookit — booking & appointment calendar Bookit < 2.6.0.1 - Unauthenticated Appointment PII Disclosure via Availability Check CVE-2026-88995 5.3 MediumSeptember 13, 2026
• stellarwp the events calendar The Events Calendar <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation CVE-2026-78159 Public exploit 9.8 CriticalSeptember 12, 2026
• stellarwp the events calendar The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution CVE-2026-78006 Public exploit 9.8 CriticalSeptember 12, 2026
• stellarwp event tickets and registration Event Tickets and Registration <= 5.27.4 - Missing Authorization to Unauthenticated Stripe Credentials Update CVE-2026-3174 7.5 HighSeptember 8, 2026
• Show olderLoading…