Event Tickets CVE-2026-93526

Exploitable by a remote unauthenticated attacker (PR:N) against the Event Tickets WordPress plugin at version 5.29.4 or earlier, but requires victim interaction (UI:R) - the target must click a crafted link or load attacker-influenced content for the injected script to reflect and execute. Realistic impact is limited to what the victim's browser session permits (S:C, C:L/I:L); highest value when a logged-in administrator or ticket purchaser is targeted. Limiting factors: the plugin must be installed and the vulnerable input path must be reachable/rendered, and no server-side code execution or data compromise occurs without a victim's browser action.

This is a moderate-priority issue that should be patched but does not represent an urgent, mass-exploitation threat based on current signals. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, 7.1) indicates a network-reachable, low-complexity flaw requiring no privileges - but critically, UI:R means a victim must be lured into interacting (clicking a crafted link or visiting a poisoned page), which is the classic signature of a reflected/DOM XSS rather than a fully autonomous exploit. The scope change (S:C) and the low C/I/A impacts reflect that injected script executes in the victim's browser session against the WordPress origin, not against the server directly. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active exploitation or automatable weaponization; the elevated 7.1 is driven largely by S:C and PR:N rather than by demonstrated real-world abuse. The A:L (availability) rating is questionable for XSS and appears generous - Patchstack commonly assigns nominal low impacts across all three metrics. Net: real but not critical; prioritize based on whether Event Tickets is internet-facing and whether admin/purchaser sessions are high-value.

An attacker crafts a malicious URL or form input targeting a vulnerable Event Tickets parameter on a public WordPress site and delivers it to a victim (site visitor, ticket purchaser, or logged-in administrator) via phishing or a poisoned link. When the victim opens the link, unsanitized input is reflected into the page and the attacker's JavaScript executes in the victim's browser under the site origin, enabling session/cookie theft or actions in the victim's context. No POC is published in the available data, and successful exploitation depends on the victim actually interacting with the malicious content.