# cve.now: Nexcess

The newest entries naming Nexcess as an affected vendor (up to 200), of 28 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-116853](https://cve.now/CVE-2026-116853.md): WordPress GiveWP plugin \<= 4.19.0.1 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2026-104672](https://cve.now/CVE-2026-104672.md): WordPress GiveWP plugin \<= 4.17.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-104405](https://cve.now/CVE-2026-104405.md): WordPress GiveWP plugin \<= 4.17.0 - Privilege Escalation vulnerability (CVSS 8.1)
- [CVE-2026-97285](https://cve.now/CVE-2026-97285.md): WordPress The Events Calendar plugin \<= 6.17.5 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2026-97266](https://cve.now/CVE-2026-97266.md): WordPress Virtue/Ascend/Pinnacle Toolkit plugin \<= 4.9.12.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-97066](https://cve.now/CVE-2026-97066.md): WordPress GiveWP plugin \<= 4.16.9 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.3)
- [CVE-2026-96834](https://cve.now/CVE-2026-96834.md): WordPress GiveWP plugin \<= 4.16.9 - Sensitive Data Exposure vulnerability (CVSS 6.5)
- [CVE-2026-96830](https://cve.now/CVE-2026-96830.md): WordPress GiveWP plugin \<= 4.16.9 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-94677](https://cve.now/CVE-2026-94677.md): WordPress Kadence WooCommerce Email Designer plugin \<= 1.5.19.1 - PHP Object Injection vulnerability (CVSS 7.2)
- [CVE-2026-93526](https://cve.now/CVE-2026-93526.md): WordPress Event Tickets plugin \<= 5.29.4 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-84767](https://cve.now/CVE-2026-84767.md): WordPress BookIt plugin \<= 2.6.0.3 - Bypass Vulnerability vulnerability (CVSS 5.3)
- [CVE-2026-78265](https://cve.now/CVE-2026-78265.md): WordPress The Events Calendar plugin \<= 6.17.2 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2026-78263](https://cve.now/CVE-2026-78263.md): WordPress Event Tickets plugin \<= 5.29.2.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-73997](https://cve.now/CVE-2026-73997.md): WordPress Starter Templates by Kadence WP plugin \<= 2.3.3 - Denial of Service Attack vulnerability (CVSS 7.5)
- [CVE-2026-73352](https://cve.now/CVE-2026-73352.md): WordPress GiveWP plugin \<= 4.16.5.1 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2026-73348](https://cve.now/CVE-2026-73348.md): WordPress GiveWP plugin \< 4.16.6 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2026-73357](https://cve.now/CVE-2026-73357.md): WordPress GiveWP plugin \< 4.16.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-73349](https://cve.now/CVE-2026-73349.md): WordPress GiveWP plugin \< 4.16.6 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-66696](https://cve.now/CVE-2026-66696.md): WordPress Gutenberg Blocks by Kadence Blocks plugin \<= 3.7.8 - Sensitive Data Exposure vulnerability (CVSS 4.3)
- [CVE-2026-66690](https://cve.now/CVE-2026-66690.md): WordPress GiveWP plugin \<= 4.16.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-28005](https://cve.now/CVE-2026-28005.md): WordPress Kadence WooCommerce Email Designer plugin \<= 1.5.19 - Privilege Escalation vulnerability (CVSS 9.8)
- [CVE-2026-65441](https://cve.now/CVE-2026-65441.md): WordPress GiveWP plugin \<= 4.16.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-65567](https://cve.now/CVE-2026-65567.md): WordPress Event Tickets plugin \<= 5.29.0.1 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-65473](https://cve.now/CVE-2026-65473.md): WordPress Virtue/Ascend/Pinnacle Toolkit plugin \<= 4.9.12 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-65464](https://cve.now/CVE-2026-65464.md): WordPress GiveWP plugin \<= 4.16.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4)
- [CVE-2026-57705](https://cve.now/CVE-2026-57705.md): WordPress Event Tickets plugin \<= 5.28.5 - Broken Access Control vulnerability (CVSS 7.5)
- [CVE-2026-57661](https://cve.now/CVE-2026-57661.md): WordPress WPComplete plugin \<= 2.9.5.5 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2026-42750](https://cve.now/CVE-2026-42750.md): WordPress WPComplete plugin \<= 2.9.5.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/nexcess
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.