# cve.now: Liquid WEB / Stellarwp

The newest entries naming Liquid WEB / Stellarwp as an affected vendor (up to 200), of 39 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-123464](https://cve.now/CVE-2026-123464.md): WordPress The Events Calendar plugin \<= 6.18.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-123469](https://cve.now/CVE-2026-123469.md): WordPress The Events Calendar plugin \<= 6.18.3 - Content Injection vulnerability (CVSS 5.3)
- [CVE-2026-62048](https://cve.now/CVE-2026-62048.md): WordPress BookIt plugin \<= 2.6.0.6 - SQL Injection vulnerability (CVSS 9.3)
- [CVE-2026-62019](https://cve.now/CVE-2026-62019.md): WordPress BookIt plugin \<= 2.6.0.6 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-62047](https://cve.now/CVE-2026-62047.md): WordPress Event Tickets plugin \<= 5.30.2 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-62055](https://cve.now/CVE-2026-62055.md): WordPress Event Tickets plugin \<= 5.30.2 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-119367](https://cve.now/CVE-2026-119367.md): WordPress The Events Calendar plugin \<= 6.18.2 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2026-119369](https://cve.now/CVE-2026-119369.md): WordPress The Events Calendar plugin \<= 6.18.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-119368](https://cve.now/CVE-2026-119368.md): WordPress The Events Calendar plugin \<= 6.18.2 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-119370](https://cve.now/CVE-2026-119370.md): WordPress The Events Calendar plugin \<= 6.18.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-39742](https://cve.now/CVE-2026-39742.md): WordPress Gutenberg Blocks by Kadence Blocks plugin \<= 3.8.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-115602](https://cve.now/CVE-2026-115602.md): WordPress Gutenberg Blocks by Kadence Blocks plugin \<= 3.8.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-110902](https://cve.now/CVE-2026-110902.md): WordPress Event Tickets plugin \<= 5.30.1 - Insecure Direct Object References (IDOR) vulnerability (CVSS 4.3)
- [CVE-2026-111396](https://cve.now/CVE-2026-111396.md): WordPress Advanced Post Manager plugin \<= 4.5.6 - Broken Access Control vulnerability (CVSS 7.1)
- [CVE-2026-110903](https://cve.now/CVE-2026-110903.md): WordPress The Events Calendar plugin \<= 6.18.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-110900](https://cve.now/CVE-2026-110900.md): WordPress BookIt plugin \<= 2.6.0.5 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-96333](https://cve.now/CVE-2026-96333.md): WordPress GiveWP plugin \<= 4.16.8.1 - Payment Bypass vulnerability (CVSS 7.5)
- [CVE-2026-105893](https://cve.now/CVE-2026-105893.md): WordPress Event Tickets plugin \<= 5.30.0.1 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-105891](https://cve.now/CVE-2026-105891.md): WordPress Event Tickets plugin \<= 5.30.0.1 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-105890](https://cve.now/CVE-2026-105890.md): WordPress Gutenberg Blocks by Kadence Blocks plugin \<= 3.7.12 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-105888](https://cve.now/CVE-2026-105888.md): WordPress Event Tickets plugin \<= 5.30.0.1 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2026-66479](https://cve.now/CVE-2026-66479.md): WordPress WPComplete plugin \<= 2.9.5.6 - CSRF to Stored XSS vulnerability (CVSS 7.1)
- [CVE-2026-106600](https://cve.now/CVE-2026-106600.md): WordPress GiveWP plugin \<= 4.18.0 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-95606](https://cve.now/CVE-2026-95606.md): WordPress The Events Calendar plugin \<= 6.17.4 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2026-97283](https://cve.now/CVE-2026-97283.md): WordPress Advanced Post Manager plugin \<= 4.5.5 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2026-104675](https://cve.now/CVE-2026-104675.md): WordPress Event Tickets plugin \<= 5.30.0 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-104404](https://cve.now/CVE-2026-104404.md): WordPress GiveWP plugin \<= 4.17.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-103354](https://cve.now/CVE-2026-103354.md): WordPress Gutenberg Blocks by Kadence Blocks plugin \<= 3.7.11.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-97287](https://cve.now/CVE-2026-97287.md): WordPress Event Tickets plugin \<= 5.29.5 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2026-97196](https://cve.now/CVE-2026-97196.md): WordPress GiveWP plugin \<= 4.16.9 - Broken Authentication vulnerability (CVSS 9.1)
- [CVE-2026-82222](https://cve.now/CVE-2026-82222.md): WordPress GiveWP plugin \<= 4.16.7.1 - Remote Code Execution (RCE) vulnerability (CVSS 10.0)
- [CVE-2026-66599](https://cve.now/CVE-2026-66599.md): WordPress WPComplete plugin \<= 2.9.5.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-49772](https://cve.now/CVE-2026-49772.md): WordPress The Events Calendar plugin 6.15.12-6.16.2 - SQL Injection vulnerability (CVSS 9.3)
- [CVE-2026-42662](https://cve.now/CVE-2026-42662.md): WordPress Event Tickets plugin \<= 5.27.5 - Bypass Vulnerability vulnerability (CVSS 6.5)
- [CVE-2026-34900](https://cve.now/CVE-2026-34900.md): WordPress GiveWP plugin \<= 4.14.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-40780](https://cve.now/CVE-2026-40780.md): WordPress BookIt plugin \< 2.5.4.1 - Broken Authentication vulnerability (CVSS 7.5)
- [CVE-2026-42678](https://cve.now/CVE-2026-42678.md): WordPress GiveWP plugin \<= 4.14.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-66533](https://cve.now/CVE-2025-66533.md): WordPress GiveWP plugin \<= 4.13.1 - Arbitrary Shortocde Execution vulnerability (CVSS 6.5)
- [CVE-2023-23672](https://cve.now/CVE-2023-23672.md): WordPress GiveWP plugin \<= 2.25.1 - Arbitrary Content Deletion vulnerability (CVSS 5.4)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/liquid-web-stellarwp
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.