Event Tickets
Monthly
Authenticated SQL injection in the Event Tickets WordPress plugin through version 5.29.5 allows any account holding the Contributor role to inject arbitrary SQL through plugin-supplied input, giving read access to data well beyond what the plugin itself stores (CVSS 3.1: 8.5, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L). The practical barrier is the Contributor authentication requirement, which limits mass exploitation but is trivially satisfied on sites with open registration or large numbers of low-trust contributors; the Scope:Changed rating reflects that successful injection can expose the broader WordPress database, not just plugin tables. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has not published a fixed version in the available data, so this is a genuine mid-to-high priority issue rather than an emergency.
Unauthenticated cross-site scripting in the Event Tickets WordPress plugin through version 5.29.4 enables remote attackers to inject malicious scripts into pages viewed by victims, potentially allowing session hijacking or defacement if a privileged user is tricked into interacting with a crafted link. The vulnerability requires victim interaction (UI:R) and is exploitable without authentication (PR:N), but impact is limited to the victim's browser context (C:L/I:L, S:C). No public exploit code or active exploitation has been identified at time of analysis, and this is assessed as a moderate-priority issue that should be patched but does not represent an urgent, mass-exploitation threat based on current signals.
Unauthenticated cross-site scripting in the Event Tickets WordPress plugin (versions ≤ 5.29.2.1) allows remote, unauthenticated attackers to inject and execute arbitrary JavaScript in victims' browsers by delivering a crafted link or triggering stored output. The scope-changed CVSS vector (S:C) indicates the injected script can operate outside the plugin's own execution boundary, enabling session theft, credential harvesting, or defacement against authenticated WordPress users who interact with affected pages. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Broken access control in the Event Tickets WordPress plugin (versions up to and including 5.28.5) lets remote unauthenticated attackers modify data they should not be able to reach because an authorization check is missing on a privileged action. The flaw carries a 7.5 CVSS with an integrity-only impact (I:H) and no confidentiality or availability effect, and there is no public exploit identified at time of analysis. It was disclosed by Patchstack and affects default installations of the plugin.
Event Tickets, the WordPress ticketing and event registration plugin maintained by Liquid Web / StellarWP, lacks an authorization check in at least one of its features through version 5.30.2, letting a logged-in low-privilege user perform an action that should require higher permissions and thereby alter site data (integrity impact only). The flaw is remote and low in complexity but requires a valid account, so sites that permit open self-registration or that host many subscriber-level users carry the most exposure; confidentiality and availability are unaffected. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, which keeps this a moderate, this-month priority rather than an emergency.
Missing authorization in the WordPress plugin Event Tickets (Liquid Web / StellarWP) through version 5.30.2 allows an authenticated low-privilege user to reach functionality that should sit behind a higher access-control level, resulting in limited information disclosure (CVSS 4.3, confidentiality-only, no integrity or availability impact). The attacker must already hold a valid account on a site running the affected plugin, and no user interaction is required. Neither CISA KEV listing nor public exploit code was identified at time of analysis, so the practical risk is a real but low-urgency access-control gap rather than an emergency; the Patchstack report is the only public reference supplied and it does not state a fixed version.
Authorization bypass in the WordPress Event Tickets plugin (all versions through 5.30.1) lets an authenticated user tamper with user-controlled object keys and reach ticketing records that should belong to another attendee, customer, or event. Because exploitation requires a valid logged-in account (CVSS PR:L), the realistic exposure is limited to sites that permit self-registration or that automatically issue accounts to attendees and customers; the impact stays within unauthorized read/modification of ticketing objects (I:L, no confidentiality or availability effect), giving a moderate vendor score of 4.3. No public exploit code has been identified at time of analysis and the issue has not been added to CISA KEV.
Missing authorization checks in the WordPress Event Tickets plugin from Liquid Web / StellarWP (versions through 5.30.0) allow an authenticated low-privilege user to carry out restricted ticket-related actions they should not be permitted to perform, resulting in limited integrity impact with no data disclosure or denial of service. As confirmed by the CVSS vector (PR:L), exploitation requires a valid account on the target site at a low privilege level - typically a self-registered subscriber, customer, or event attendee - so sites that allow open user registration carry more exposure than those with registration closed. No public exploit code has been identified at time of analysis and the issue is not reported as actively exploited; the assessed severity is low (CVSS 4.3), making this a genuine-but-low-priority hardening item rather than an emergency patch.
An unauthenticated broken access control vulnerability in Event Tickets through version 5.29.0.1 allows remote attackers to modify event ticket data without authentication. The vulnerability affects installations of the WordPress plugin where default configurations are in place, permitting unauthorized integrity impact. No active exploitation or public exploit code has been reported at the time of this analysis.
Unauthenticated authentication bypass in the Event Tickets WordPress plugin (versions ≤ 5.27.5 by Liquid Web / StellarWP) allows remote attackers to circumvent access controls without any credentials, affecting the integrity and availability of ticketing functionality. Classified under CWE-290 (Authentication Bypass by Spoofing), the CVSS vector confirms PR:N and AV:N - meaning any network-accessible attacker can attempt exploitation with low complexity and no user interaction required. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA's KEV catalog, indicating no confirmed active exploitation.
The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'ajax_ticket_delete' function in all versions up to, and. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Event Tickets and Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.18.1 via the tc-order-id parameter due to missing. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the contributor role from leaking the attendees list on any post type regardless of status. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Event Tickets and Registration WordPress plugin before 5.8.1, Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the contributor role from leaking the. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'email' action in all versions up to, and including,. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
CSV injection in the event-tickets (Event Tickets) plugin before 4.10.7.2 for WordPress exists via the "All Post> Ticketed > Attendees" Export Attendees feature. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Authenticated SQL injection in the Event Tickets WordPress plugin through version 5.29.5 allows any account holding the Contributor role to inject arbitrary SQL through plugin-supplied input, giving read access to data well beyond what the plugin itself stores (CVSS 3.1: 8.5, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L). The practical barrier is the Contributor authentication requirement, which limits mass exploitation but is trivially satisfied on sites with open registration or large numbers of low-trust contributors; the Scope:Changed rating reflects that successful injection can expose the broader WordPress database, not just plugin tables. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has not published a fixed version in the available data, so this is a genuine mid-to-high priority issue rather than an emergency.
Unauthenticated cross-site scripting in the Event Tickets WordPress plugin through version 5.29.4 enables remote attackers to inject malicious scripts into pages viewed by victims, potentially allowing session hijacking or defacement if a privileged user is tricked into interacting with a crafted link. The vulnerability requires victim interaction (UI:R) and is exploitable without authentication (PR:N), but impact is limited to the victim's browser context (C:L/I:L, S:C). No public exploit code or active exploitation has been identified at time of analysis, and this is assessed as a moderate-priority issue that should be patched but does not represent an urgent, mass-exploitation threat based on current signals.
Unauthenticated cross-site scripting in the Event Tickets WordPress plugin (versions ≤ 5.29.2.1) allows remote, unauthenticated attackers to inject and execute arbitrary JavaScript in victims' browsers by delivering a crafted link or triggering stored output. The scope-changed CVSS vector (S:C) indicates the injected script can operate outside the plugin's own execution boundary, enabling session theft, credential harvesting, or defacement against authenticated WordPress users who interact with affected pages. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Broken access control in the Event Tickets WordPress plugin (versions up to and including 5.28.5) lets remote unauthenticated attackers modify data they should not be able to reach because an authorization check is missing on a privileged action. The flaw carries a 7.5 CVSS with an integrity-only impact (I:H) and no confidentiality or availability effect, and there is no public exploit identified at time of analysis. It was disclosed by Patchstack and affects default installations of the plugin.
Event Tickets, the WordPress ticketing and event registration plugin maintained by Liquid Web / StellarWP, lacks an authorization check in at least one of its features through version 5.30.2, letting a logged-in low-privilege user perform an action that should require higher permissions and thereby alter site data (integrity impact only). The flaw is remote and low in complexity but requires a valid account, so sites that permit open self-registration or that host many subscriber-level users carry the most exposure; confidentiality and availability are unaffected. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, which keeps this a moderate, this-month priority rather than an emergency.
Missing authorization in the WordPress plugin Event Tickets (Liquid Web / StellarWP) through version 5.30.2 allows an authenticated low-privilege user to reach functionality that should sit behind a higher access-control level, resulting in limited information disclosure (CVSS 4.3, confidentiality-only, no integrity or availability impact). The attacker must already hold a valid account on a site running the affected plugin, and no user interaction is required. Neither CISA KEV listing nor public exploit code was identified at time of analysis, so the practical risk is a real but low-urgency access-control gap rather than an emergency; the Patchstack report is the only public reference supplied and it does not state a fixed version.
Authorization bypass in the WordPress Event Tickets plugin (all versions through 5.30.1) lets an authenticated user tamper with user-controlled object keys and reach ticketing records that should belong to another attendee, customer, or event. Because exploitation requires a valid logged-in account (CVSS PR:L), the realistic exposure is limited to sites that permit self-registration or that automatically issue accounts to attendees and customers; the impact stays within unauthorized read/modification of ticketing objects (I:L, no confidentiality or availability effect), giving a moderate vendor score of 4.3. No public exploit code has been identified at time of analysis and the issue has not been added to CISA KEV.
Missing authorization checks in the WordPress Event Tickets plugin from Liquid Web / StellarWP (versions through 5.30.0) allow an authenticated low-privilege user to carry out restricted ticket-related actions they should not be permitted to perform, resulting in limited integrity impact with no data disclosure or denial of service. As confirmed by the CVSS vector (PR:L), exploitation requires a valid account on the target site at a low privilege level - typically a self-registered subscriber, customer, or event attendee - so sites that allow open user registration carry more exposure than those with registration closed. No public exploit code has been identified at time of analysis and the issue is not reported as actively exploited; the assessed severity is low (CVSS 4.3), making this a genuine-but-low-priority hardening item rather than an emergency patch.
An unauthenticated broken access control vulnerability in Event Tickets through version 5.29.0.1 allows remote attackers to modify event ticket data without authentication. The vulnerability affects installations of the WordPress plugin where default configurations are in place, permitting unauthorized integrity impact. No active exploitation or public exploit code has been reported at the time of this analysis.
Unauthenticated authentication bypass in the Event Tickets WordPress plugin (versions ≤ 5.27.5 by Liquid Web / StellarWP) allows remote attackers to circumvent access controls without any credentials, affecting the integrity and availability of ticketing functionality. Classified under CWE-290 (Authentication Bypass by Spoofing), the CVSS vector confirms PR:N and AV:N - meaning any network-accessible attacker can attempt exploitation with low complexity and no user interaction required. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA's KEV catalog, indicating no confirmed active exploitation.
The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'ajax_ticket_delete' function in all versions up to, and. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Event Tickets and Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.18.1 via the tc-order-id parameter due to missing. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the contributor role from leaking the attendees list on any post type regardless of status. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Event Tickets and Registration WordPress plugin before 5.8.1, Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the contributor role from leaking the. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'email' action in all versions up to, and including,. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
CSV injection in the event-tickets (Event Tickets) plugin before 4.10.7.2 for WordPress exists via the "All Post> Ticketed > Attendees" Export Attendees feature. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.