en
Liquid Web / StellarWP is a WordPress software organization and brand portfolio that provides plugins, themes, hosting-related solutions, and supporting tools. Its products serve website owners, developers, nonprofits, educators, and businesses, covering event management, fundraising, content creation, learning, security, and site administration across the WordPress ecosystem.
As of 10/22/2026, Liquid Web / StellarWP recorded 20 security vulnerabilities in the last 90 days across 7 products, including 10 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, Event Tickets had the most security vulnerabilities in the Liquid Web / StellarWP ecosystem, with 6 vulnerabilities—approximately 30% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-110902WordPress Event Tickets plugin <= 5.30.1 - Insecure Direct Object References (IDOR) vulnerabilityCVE-2026-111396WordPress Advanced Post Manager plugin <= 4.5.6 - Broken Access Control vulnerabilityCVE-2026-110903WordPress The Events Calendar plugin <= 6.18.1 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-110900WordPress BookIt plugin <= 2.6.0.5 - Broken Access Control vulnerabilityCVE-2026-96333WordPress GiveWP plugin <= 4.16.8.1 - Payment Bypass vulnerability| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-110902WordPress Event Tickets plugin <= 5.30.1 - Insecure Direct Object References (IDOR) vulnerability | Exploitation statusNot exploited | FixYes |
| Affected productEvent Tickets |
| Published10/19/2026 |
| SeverityMedium |
CVE-2026-111396WordPress Advanced Post Manager plugin <= 4.5.6 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productAdvanced Post Manager | Published10/16/2026 | SeverityHigh |
|---|
CVE-2026-110903WordPress The Events Calendar plugin <= 6.18.1 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Affected productThe Events Calendar | Published10/16/2026 | SeverityMedium |
|---|
CVE-2026-110900WordPress BookIt plugin <= 2.6.0.5 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productBookIt | Published10/16/2026 | SeverityMedium |
|---|
CVE-2026-96333WordPress GiveWP plugin <= 4.16.8.1 - Payment Bypass vulnerability | Exploitation statusNot exploited | FixYes | Affected productGiveWP | Published10/09/2026 | SeverityHigh |
|---|
CVE-2026-105893WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productEvent Tickets | Published10/08/2026 | SeverityMedium |
|---|
CVE-2026-105891WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productEvent Tickets | Published10/08/2026 | SeverityMedium |
|---|
CVE-2026-105890WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.12 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Affected productGutenberg Blocks by Kadence Blocks | Published10/08/2026 | SeverityMedium |
|---|
CVE-2026-105888WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productEvent Tickets | Published10/08/2026 | SeverityMedium |
|---|
CVE-2026-66479WordPress WPComplete plugin <= 2.9.5.6 - CSRF to Stored XSS vulnerability | Exploitation statusNot exploited | FixYes | Affected productWPComplete | Published10/08/2026 | SeverityHigh |
|---|
27 Results | Page 1 of 3