EUVD-2026-44894
GHSA-r4f4-cp69-p8vr
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
PR:L for required contributor access; UI:R because payload detonation requires the victim to have previously added the specific ticket to their cart, constituting a prerequisite user action; S:C for victim browser scope change.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Tickera - Sell Tickets & Manage Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'price_wrapper' Shortcode Attribute in all versions up to, and including, 3.6.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful execution of the injected script is limited to victims who have the referenced ticket ID present in their cart cookie, meaning the payload only fires for users who have previously added that ticket to their cart.
AnalysisAI
Stored Cross-Site Scripting in the Tickera - Sell Tickets & Manage Events WordPress plugin (all versions through 3.6.0.0) allows authenticated contributors to inject persistent malicious scripts via the price_wrapper shortcode attribute, due to missing sanitization and output escaping in class.shortcodes.php. A compromised or malicious contributor account can plant the payload in any page or post, where it executes against visiting victims - but only those who carry the referenced ticket ID in their cart cookie, materially narrowing the realistic victim pool. No active exploitation has been confirmed in CISA KEV, and no EPSS data was provided in the intelligence feed.
Technical ContextAI
The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the stored variant. The vulnerability exists in the Tickera plugin's shortcode handler at class.shortcodes.php lines 33, 212, and 232, where the price_wrapper shortcode renders contributor-supplied attribute values directly into page HTML without sanitization on input or escaping on output. WordPress plugins processing shortcode attributes must explicitly call wp_kses(), esc_attr(), or esc_html() before rendering; the absence of these calls in the affected code paths allows arbitrary HTML and JavaScript injection. The cart cookie dependency for payload detonation suggests the shortcode conditionally renders content based on a victim-side cookie value, creating an unusual trigger condition that both limits and potentially targets the attack toward active shoppers. Affected product is confirmed via CPE cpe:2.3:a:tickera:tickera_-_sell_tickets_&_manage_events:*:*:*:*:*:*:*:* covering all versions through 3.6.0.0.
RemediationAI
A code changeset has been committed to the WordPress plugin repository (https://plugins.trac.wordpress.org/changeset?reponame=&old=3605637%40tickera-event-ticketing-system&new=3605637%40tickera-event-ticketing-system), indicating an upstream fix is available; however, the specific patched release version number is not confirmed by the available intelligence data. Site administrators should update the Tickera plugin to the latest version available via the WordPress plugin dashboard or repository immediately. As a compensating control prior to patching, restrict contributor-level role assignment to trusted users only - this eliminates the required privilege level for exploitation and is the most targeted mitigation available given the attack vector. Disabling the price_wrapper shortcode server-side, if feasible through a mu-plugin filter (remove_shortcode), would eliminate the vulnerable code path entirely without requiring the plugin update, though this disables associated pricing display functionality. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/f266f9db-a25e-4f50-b3c8-3bea3a7e86ce should be monitored for a confirmed patched version number.
The Tickera WordPress plugin before 3.4.8.3 does not properly sanitise and escape the Name fields of booked Events befor
Unauthenticated PHP Object Injection affects the Tickera event ticketing plugin for WordPress in all versions up to and
The Tickera - WordPress Event Ticketing plugin for WordPress is vulnerable to arbitrary shortcode execution in all versi
SQL injection in the Tickera - Sell Tickets & Manage Events WordPress plugin (all versions through 3.6.0.1) allows authe
SQL Injection in the Tickera - Sell Tickets & Manage Events WordPress plugin (all versions through 3.6.0.0) permits auth
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in v
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low at
Missing Authorization vulnerability in Tickera Tickera tickera-event-ticketing-system allows Exploiting Incorrectly Conf
The Tickera - WordPress Event Ticketing plugin for WordPress is vulnerable to unauthorized loss of data due to a missing
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today