Event Tickets CVE-2026-78263

The vulnerable WordPress site must have the Event Tickets plugin (by Nexcess) installed and active at version 5.29.2.1 or earlier. The plugin must expose at least one user-facing form or display field (such as ticket purchase, RSVP, or attendee information) that is rendered in HTML responses without output encoding - the specific vulnerable input field is not named in the available data. Exploitation additionally requires that a victim user (ideally an authenticated WordPress admin or editor) loads a page containing the attacker's injected content (UI:R). Factors limiting exploitation: victim interaction is mandatory, meaning fully automated worm-style propagation is not possible; the C:L/I:L/A:L ratings indicate per-session impact is bounded unless the victim holds elevated WordPress privileges; and the vulnerability does not provide direct server-side code execution without chaining additional techniques.

The CVSS 3.1 base score of 7.1 with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L positions this as a medium-high severity issue. The PR:N and AC:L combination means exploitation is low-friction for any internet-reachable WordPress site running the plugin, though UI:R (victim must load or interact with the injected content) limits fully automated, hands-off exploitation. The scope change (S:C) elevates real-world risk: a successful XSS against an administrator session can escalate to full site compromise via WordPress admin actions. No EPSS data was provided in the intelligence set, so probabilistic exploitation likelihood cannot be quantified. KEV status is negative and no POC has been confirmed, suggesting opportunistic mass exploitation is not yet occurring. Overall, this is a genuine priority for any public-facing WordPress deployment using this plugin - the low attack complexity and no-authentication requirement make it accessible to a wide attacker population, even if individual impact per session is bounded by the C:L/I:L/A:L ratings.

An attacker identifies a public WordPress site running Event Tickets ≤ 5.29.2.1 and submits a ticket purchase or RSVP form with a payload such as a malicious script embedded in a name or comment field. When an authenticated WordPress administrator reviews the submission or loads the affected event page, the unsanitized script executes in their browser, enabling the attacker to steal the admin session cookie and gain full control of the WordPress instance. No POC code has been publicly confirmed, but the low-complexity, unauthenticated vector makes independent rediscovery straightforward.