These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The CVE-2026-105893 vulnerability affects the WordPress Event Tickets plugin, specifically versions up to 5.30.0.1. This issue is related to a Broken Access Control vulnerability, which could potentially allow unauthorized access to certain features or data. The vulnerability has been categorized with a CVSS score of 5.3 and a severity of MEDIUM. Defenders responsible for WordPress installations with the [truncated]
The CVE-2026-105891 vulnerability affects the WordPress Event Tickets plugin, specifically versions up to 5.30.0.1. This issue is related to a Missing Authorization vulnerability, which allows for Exploiting Incorrectly Configured Access Control Security Levels. The CVSS score for this vulnerability is 4.3, indicating a Medium severity level. Defenders should verify the version of the Event Tickets plugin [truncated]
The Gutenberg Blocks by Kadence Blocks plugin for WordPress has a Cross Site Scripting (XSS) vulnerability, affecting versions up to 3.7.12. This issue, tracked as CVE-2026-105890, allows for Stored XSS attacks. Defenders should assess exposure and prioritize verification and updates to version 3.7.12.1 or later. The CVE record was published on 2026-10-08T13:02:50.319Z and has not been modified since then [truncated]
The CVE-2026-105888 vulnerability affects the WordPress Event Tickets plugin, specifically versions up to 5.30.0.1. This issue is related to a Missing Authorization vulnerability, which allows for Exploiting Incorrectly Configured Access Control Security Levels. The CVSS score for this vulnerability is 5.4, indicating a medium severity level. Defenders responsible for WordPress installations with the Even [truncated]
A Cross-Site Request Forgery (CSRF) vulnerability exists in the WPComplete plugin for WordPress, allowing for Stored XSS attacks. This issue affects WPComplete versions up to and including 2.9.5.6. The vulnerability enables attackers to trick users into performing unintended actions, potentially leading to Stored XSS attacks. Defenders should assess exposure and apply patches to prevent exploitation. The [truncated]
The CVE-2026-106600 vulnerability affects WordPress GiveWP plugin versions up to and including 4.18.0. It's a missing authorization issue that allows exploiting incorrectly configured access control security levels, with a CVSS score of 5.3 and medium severity. This issue may allow unauthorized access if not properly mitigated. Defenders should verify plugin versions, assess exposure, and prioritize updat [truncated]
A critical vulnerability was found in the WordPress The Events Calendar plugin, allowing for PHP Object Injection due to deserialization of untrusted data. This issue affects versions up to 6.17.4. The vulnerability has a CVSS score of 9.8 and is considered critical, potentially leading to code execution and data breaches. WordPress administrators and users of The Events Calendar plugin should assess thei [truncated]
A Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Event Tickets: from n/a through 5.30.0. The vulnerability has a CVSS score of 4.3 and a MEDIUM severity. Defenders should assess exposure and prioritize verification and remediation efforts. The CVE record and NVD entry provide limited in [truncated]
A Cross-site Scripting (XSS) vulnerability exists in GiveWP, a WordPress plugin developed by Liquid Web / StellarWP. The vulnerability, classified as CWE-79, allows for Stored XSS attacks. This issue affects GiveWP versions from n/a through 4.17.0. The vulnerability can be exploited by injecting malicious scripts into web pages generated by GiveWP, potentially leading to unauthorized actions or data breac [truncated]
CVE-2026-103354 is a Stored Cross-site Scripting (XSS) vulnerability in the Gutenberg Blocks by Kadence Blocks plugin for WordPress. The issue affects versions from n/a through 3.7.11.1. Defenders should assess exposure, prioritize remediation, and verify inventory for this plugin. This vulnerability allows for Stored XSS attacks, which can lead to unauthorized modifications of web content. Defenders shou [truncated]
CVE-2026-66599 is a high-severity unauthenticated Cross Site Scripting (XSS) vulnerability in WPComplete versions up to 2.9.5.6. The CVE record was published on 2026-08-24T12:16:52.980Z and was last modified on 2026-10-12T15:10:00.207Z. The NVD entry is currently Deferred.
A critical vulnerability was discovered in The Events Calendar plugin, affecting versions from 6.15.12 through 6.16.2. This vulnerability, CVE-2026-49772, is an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') issue, which allows for blind SQL injection attacks. The CVSS score for this vulnerability is 9.3, indicating a critical severity level.
CVE-2026-42662 is a MEDIUM severity vulnerability (CVSS Score: 6.5) in the Event Tickets plugin versions <= 5.27.5. The vulnerability is described as an unauthenticated bypass vulnerability. The CVE was published on [cvePublishedAt](https://www.cve.org/CVERecord?id=CVE-2026-42662) and last modified on [cveModifiedAt](https://nvd.nist.gov/vuln/detail/CVE-2026-42662). The vulnerability's details are sourced [truncated]
CVE-2026-34900 is a HIGH severity Unauthenticated Cross Site Scripting (XSS) vulnerability in GiveWP versions <= 4.14.2. The vulnerability has a CVSS score of 7.1 and was published on {cvePublishedAt}.
PatchSiren defensive debrief for CVE-2026-42678 — DOM-Based Cross-Site Scripting (XSS) in GiveWP WordPress plugin.
