Skip to content
OpenAdvisories

Vendor

Liquid Web / StellarWP

39 known vulnerabilities.

Liquid Web / StellarWP at a glance

Last 12 months
38
Critical · all time
6
Exploited · all time
0
Public exploit · all time
2
New vulnerabilities per month · last 12 months
0 13 25 December 2025: 1 vulnerability Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 5 vulnerabilities, 1 critical Jun July 2026: 0 vulnerabilities August 2026: 2 vulnerabilities, 1 critical September 2026: 2 vulnerabilities, 1 critical Sep October 2026: 25 vulnerabilities, 2 critical November 2026: 3 vulnerabilities, 1 critical
Show as table
MonthVulnerabilitiesCritical
Nov 202631
Oct 2026252
Sep 202621
Aug 202621
Jul 202600
Jun 202651
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202510
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202510
Dec 202400

Products

The Events Calendar 9 Event Tickets 9 GiveWP 9 BookIt 4 Gutenberg Blocks by Kadence Blocks 4 Advanced Post Manager 2 WPComplete 2
All Critical High Medium Low Exploited only Public exploit

39 results · Feed

  • Medium 6.5
    CVE-2026-123464

    WordPress The Events Calendar plugin <= 6.18.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Stored XSS.This issue affects The Events Calendar: from n/a through 6.18.3.

    Liquid Web / StellarWP The Events Calendar
  • Medium 5.3
    CVE-2026-123469

    WordPress The Events Calendar plugin <= 6.18.3 - Content Injection vulnerability

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Code Injection.This issue affects The Events Calendar: from n/a through 6.18.3.

    Liquid Web / StellarWP The Events Calendar
  • Critical 9.3
    CVE-2026-62048

    WordPress BookIt plugin <= 2.6.0.6 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP BookIt bookit allows SQL Injection.This issue affects BookIt: from n/a through 2.6.0.6.

    Liquid Web / StellarWP BookIt
  • Medium 4.3
    CVE-2026-62019

    WordPress BookIt plugin <= 2.6.0.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Liquid Web / StellarWP BookIt bookit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BookIt: from n/a through 2.6.0.6.

    Liquid Web / StellarWP BookIt
  • Medium 4.3
    CVE-2026-62047

    WordPress Event Tickets plugin <= 5.30.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.2.

    Liquid Web / StellarWP Event Tickets
  • Medium 4.3
    CVE-2026-62055

    WordPress Event Tickets plugin <= 5.30.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.2.

    Liquid Web / StellarWP Event Tickets
  • Medium 5.4
    CVE-2026-119367

    WordPress The Events Calendar plugin <= 6.18.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Events Calendar: from n/a through 6.18.2.

    Liquid Web / StellarWP The Events Calendar
  • Medium 6.5
    CVE-2026-119369

    WordPress The Events Calendar plugin <= 6.18.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Stored XSS.This issue affects The Events Calendar: from n/a through 6.18.2.

    Liquid Web / StellarWP The Events Calendar
  • Medium 5.3
    CVE-2026-119368

    WordPress The Events Calendar plugin <= 6.18.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Events Calendar: from n/a through 6.18.2.

    Liquid Web / StellarWP The Events Calendar
  • Medium 6.5
    CVE-2026-119370

    WordPress The Events Calendar plugin <= 6.18.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Stored XSS.This issue affects The Events Calendar: from n/a through 6.18.2.

    Liquid Web / StellarWP The Events Calendar
  • Medium 6.5
    CVE-2026-39742

    WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.8.0.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a th…

    Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks
  • Medium 6.5
    CVE-2026-115602

    WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.8.0.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a th…

    Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks
  • Medium 4.3
    CVE-2026-110902

    WordPress Event Tickets plugin <= 5.30.1 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.1.

    Liquid Web / StellarWP Event Tickets
  • High 7.1
    CVE-2026-111396

    WordPress Advanced Post Manager plugin <= 4.5.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Post Manager: from n/a through 4.5.6.

    Liquid Web / StellarWP Advanced Post Manager
  • Medium 6.5
    CVE-2026-110903

    WordPress The Events Calendar plugin <= 6.18.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Stored XSS.This issue affects The Events Calendar: from n/a through 6.18.1.

    Liquid Web / StellarWP The Events Calendar
  • Medium 5.3
    CVE-2026-110900

    WordPress BookIt plugin <= 2.6.0.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Liquid Web / StellarWP BookIt bookit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BookIt: from n/a through 2.6.0.5.

    Liquid Web / StellarWP BookIt
  • High 7.5
    CVE-2026-96333

    WordPress GiveWP plugin <= 4.16.8.1 - Payment Bypass vulnerability

    Authentication Bypass by Spoofing vulnerability in Liquid Web / StellarWP GiveWP give allows Identity Spoofing.This issue affects GiveWP: from n/a through 4.16.8.1.

    Liquid Web / StellarWP GiveWP
  • Medium 5.3
    CVE-2026-105893

    WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Manipulating User-Controlled Variables.This issue affects Event Tickets: from n/a through 5.30.0.1.

    Liquid Web / StellarWP Event Tickets
  • Medium 4.3
    CVE-2026-105891

    WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.0.1.

    Liquid Web / StellarWP Event Tickets
  • Medium 6.5
    CVE-2026-105890

    WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.12 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a th…

    Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks
  • Medium 5.4
    CVE-2026-105888

    WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.0.1.

    Liquid Web / StellarWP Event Tickets
  • High 7.1
    CVE-2026-66479

    WordPress WPComplete plugin <= 2.9.5.6 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Liquid Web / StellarWP WPComplete wpcomplete allows Stored XSS.This issue affects WPComplete: from n/a through 2.9.5.6.

    Liquid Web / StellarWP WPComplete
  • Medium 5.3
    CVE-2026-106600

    WordPress GiveWP plugin <= 4.18.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Liquid Web / StellarWP GiveWP give allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GiveWP: from n/a through 4.18.0.

    Liquid Web / StellarWP GiveWP
  • Critical 9.8
    CVE-2026-95606

    WordPress The Events Calendar plugin <= 6.17.4 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP The Events Calendar allows Object Injection. This issue affects The Events Calendar: from n/a through 6.17.4.

    Liquid Web / StellarWP The Events Calendar
  • Critical 9.8
    CVE-2026-97283

    WordPress Advanced Post Manager plugin <= 4.5.5 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Object Injection.This issue affects Advanced Post Manager: from n/a through 4.5.5.

    Liquid Web / StellarWP Advanced Post Manager
  • Medium 4.3
    CVE-2026-104675

    WordPress Event Tickets plugin <= 5.30.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.0.

    Liquid Web / StellarWP Event Tickets
  • Medium 6.5
    CVE-2026-104404

    WordPress GiveWP plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP GiveWP give allows Stored XSS.This issue affects GiveWP: from n/a through 4.17.0.

    Liquid Web / StellarWP GiveWP
  • High 7.1
    CVE-2026-103354

    WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.11.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a th…

    Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks
  • High 8.5
    CVE-2026-97287

    WordPress Event Tickets plugin <= 5.29.5 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Blind SQL Injection. This issue affects Event Tickets: from n/a through 5.29.5.

    Liquid Web / StellarWP Event Tickets
  • Critical 9.1
    CVE-2026-97196

    WordPress GiveWP plugin <= 4.16.9 - Broken Authentication vulnerability

    Improper Validation of Unsafe Equivalence in Input vulnerability in Liquid Web / StellarWP GiveWP allows Authentication Bypass. This issue affects GiveWP: from n/a through 4.16.9.

    Liquid Web / StellarWP GiveWP
  • Critical 10.0
    CVE-2026-82222 Public exploit

    WordPress GiveWP plugin <= 4.16.7.1 - Remote Code Execution (RCE) vulnerability

    Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP GiveWP allows Object Injection. This issue affects GiveWP: from n/a through 4.16.7.1.

    Liquid Web / StellarWP GiveWP
  • High 7.1
    CVE-2026-66599

    WordPress WPComplete plugin <= 2.9.5.6 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in WPComplete <= 2.9.5.6 versions.

    Liquid Web / StellarWP WPComplete
  • Critical 9.3
    CVE-2026-49772 Public exploit

    WordPress The Events Calendar plugin 6.15.12-6.16.2 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP The Events Calendar allows Blind SQL Injection. This issue affects The Events Calendar: from 6.15.12 through 6.16.2.

    Liquid Web / StellarWP The Events Calendar
  • Medium 6.5
    CVE-2026-42662

    WordPress Event Tickets plugin <= 5.27.5 - Bypass Vulnerability vulnerability

    Unauthenticated Bypass Vulnerability in Event Tickets <= 5.27.5 versions.

    Liquid Web / StellarWP Event Tickets
  • High 7.1
    CVE-2026-34900

    WordPress GiveWP plugin <= 4.14.2 - Reflected Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.14.2 versions.

    Liquid Web / StellarWP GiveWP
  • High 7.5
    CVE-2026-40780

    WordPress BookIt plugin < 2.5.4.1 - Broken Authentication vulnerability

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Liquid Web / StellarWP BookIt allows Password Recovery Exploitation. This issue affects BookIt: from n/a before 2.5.4.1.

    Liquid Web / StellarWP BookIt
  • High 7.1
    CVE-2026-42678

    WordPress GiveWP plugin <= 4.14.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP GiveWP allows DOM-Based XSS. This issue affects GiveWP: from n/a through 4.14.5.

    Liquid Web / StellarWP GiveWP
  • Medium 6.5
    CVE-2025-66533

    WordPress GiveWP plugin <= 4.13.1 - Arbitrary Shortocde Execution vulnerability

    Improper Control of Generation of Code ('Code Injection') vulnerability in Liquid Web / StellarWP GiveWP give allows Code Injection.This issue affects GiveWP: from n/a through 4.13.1.

    Liquid Web / StellarWP GiveWP
  • Medium 5.4
    CVE-2023-23672

    WordPress GiveWP plugin <= 2.25.1 - Arbitrary Content Deletion vulnerability

    Missing Authorization vulnerability in Liquid Web / StellarWP GiveWP.This issue affects GiveWP: from n/a through 2.25.1.

    Liquid Web / StellarWP GiveWP