What is the CVSS score of CVE-2026-14819?

CVE-2026-14819 has a CVSS 3.1 base score of 3.5 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2026-14819?

Yes, a public proof-of-concept exploit is available for CVE-2026-14819. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2026-14819?

Yes, a patch is available for CVE-2026-14819. Update the affected software to the latest version immediately.

Event Tickets And Registration CVE-2026-14819

EUVD-2026-49699 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-07-28 WPScan

GHSA-c5f6-6q68-hmm6

WordPress XSS Event Tickets And Registration Unknown

3.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

3.5 LOW

AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

Primary rating from Vendor (WPScan) · only source for this CVE.

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 14:42 vuln.today

CVSS changed

Jul 28, 2026 - 14:37 NVD

3.5 (LOW)

Patch available

Jul 28, 2026 - 07:01 EUVD

CVE Published

Jul 28, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 28, 2026 - 06:00 cve.org

LOW 3.5

DescriptionCVE.org

The Event Tickets and Registration WordPress plugin before 5.28.4 does not properly escape event titles before outputting them in a ticket history log, allowing users with the Editor role and above to perform Stored Cross-Site Scripting attacks that execute against higher-privileged users on multisite installations.

AnalysisAI

Stored cross-site scripting in the Event Tickets and Registration WordPress plugin before 5.28.4 enables Editors and above to inject malicious scripts in event titles, which execute against higher-privileged users on multisite setups when they view the ticket history log. The vulnerability has a low CVSS of 3.5 and a low EPSS of 0.15%, but exploit code is publicly available. A patch in version 5.28.4 is available from the vendor.