What is the CVSS score of CVE-2026-78263?

CVE-2026-78263 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of Event Tickets are affected by CVE-2026-78263?

The Event Tickets WordPress plugin (versions 5.29.2.1 and earlier) contains an unauthenticated cross-site scripting vulnerability enabling attackers to hijack WordPress administrator sessions and…

How to fix or mitigate CVE-2026-78263?

Within 24 hours: immediately disable the Event Tickets plugin across all WordPress installations or-if operationally critical-restrict access to authenticated users only and audit access logs for exploitation attempts. Within 7 days: contact the plugin vendor for a patch timeline and deploy Web Application Firewall (WAF) rules to block XSS payloads in event ticket parameters; patch WordPress core and all other plugins to current versions as baseline hardening. Within 30 days: deploy the patched version of Event Tickets once released after staging environment validation, enforce multi-factor authentication on all WordPress administrative accounts, and conduct phishing awareness training for staff on suspicious event ticket links.

Event Tickets CVE-2026-78263

EUVD-2026-65170 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-24 Patchstack

GHSA-58c6-r3gj-j8x2

XSS Event Tickets

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Network-delivered XSS with no auth needed, user interaction required for script execution, scope change due to cross-origin browser impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 24, 2026 - 22:24 vuln.today

CVE Published

Aug 24, 2026 - 21:31 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.2.1 versions.

AnalysisAI

Unauthenticated cross-site scripting in the Event Tickets WordPress plugin (versions ≤ 5.29.2.1) allows remote, unauthenticated attackers to inject and execute arbitrary JavaScript in victims' browsers by delivering a crafted link or triggering stored output. The scope-changed CVSS vector (S:C) indicates the injected script can operate outside the plugin's own execution boundary, enabling session theft, credential harvesting, or defacement against authenticated WordPress users who interact with affected pages. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Submit malicious XSS payload via public ticket form

Delivery

Payload stored or reflected in plugin output

Exploit

Victim admin loads affected event page

Execution

Script executes in admin browser context

Persist

Attacker captures session token

Impact

Authenticate as admin to WordPress