Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 253,029 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?event-ticketsEvent Tickets with Ticket Scannerevent-tickets-manager-for-woocommerce
Plugin · event-tickets
event-tickets
26 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 19, 2026Event Tickets: Authorization Bypass Through User-Controlled KeyCVE-2026-110902 · affects up to 5.30.1 · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.1.
Oct 8, 2026Event Tickets: Authorization Bypass Through User-Controlled KeyCVE-2026-105893 · affects up to 5.30.0.1 · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Manipulating User-Controlled Variables.This issue affects Event Tickets: from n/a through 5.30.0.1.
Oct 8, 2026Event Tickets: Missing AuthorizationCVE-2026-105891 · affects up to 5.30.0.1 · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.0.1.
Oct 8, 2026Event Tickets: Missing AuthorizationCVE-2026-105888 · affects up to 5.30.0.1 · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.0.1.
Oct 5, 2026Event Tickets: Missing AuthorizationCVE-2026-104675 · affects up to 5.30.0 · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.0.
Oct 2, 2026Event Tickets and Registration: Generic SQL InjectionCVE-2026-97634 · affects up to 5.29.5 · reported by WordfenceMedium 6.5
The Event Tickets and Registration plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 5.29.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. A Contributor-level user can reach the vulnerable code path by supplying a post_id they authored, as the can_access_page() gate requires only post authorship rather than the edit_others_posts capability for post owners.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 30, 2026Event Tickets: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-97287 · affects up to 5.29.5 · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Blind SQL Injection. This issue affects Event Tickets: from n/a through 5.29.5.
Sep 23, 2026Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.4 versions.CVE-2026-93526 · affects up to 5.29.4 · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.4 versions.
Sep 8, 2026Event Tickets and Registration: Unauthorized modification of dataCVE-2026-3174 · affects up to 5.27.4 · reported by WordfenceHigh 7.5
The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Stripe OAuth return endpoint in all versions up to, and including, 5.27.4. This makes it possible for unauthenticated attackers to overwrite the site's Stripe merchant credentials (access tokens, publishable keys, and account ID), diverting all subsequent payment processing to the attacker's Stripe account.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 24, 2026Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.2.1 versions.CVE-2026-78263 · affects up to 5.29.2.1 · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.2.1 versions.
Aug 1, 2026Event Tickets and Registration: Does not properly verify authorization on some of its seating actionsCVE-2026-14823 · fixed in 5.29.0.1 · reported by WPScanLow 2.2
The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not properly verify authorization on some of its seating actions, allowing users with contributor-level access and above to overwrite the seating layout, ticket inventory, and attendee seat assignments of events they do not own.
Aug 1, 2026Event Tickets and Registration: Does not perform any authorization check on one of its order-management REST endpointsCVE-2026-14822 · fixed in 5.29.0.1 · reported by WPScanMedium 5.3
The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not perform any authorization check on one of its order-management REST endpoints, allowing unauthenticated users to change the status of existing orders.
Jul 28, 2026Event Tickets and Registration: Does not properly escape event titles before outputting them in a ticket history logCVE-2026-14819 · fixed in 5.28.4 · reported by WPScanLow 3.5
The Event Tickets and Registration WordPress plugin before 5.28.4 does not properly escape event titles before outputting them in a ticket history log, allowing users with the Editor role and above to perform Stored Cross-Site Scripting attacks that execute against higher-privileged users on multisite installations.
Jul 27, 2026Unauthenticated Broken Access Control in Event Tickets <= 5.29.0.1 versions.CVE-2026-65567 · affects up to 5.29.0.1 · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Event Tickets <= 5.29.0.1 versions.
Jul 13, 2026Event Tickets: Missing AuthorizationCVE-2026-57705 · affects up to 5.28.5 · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Nexcess Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through <= 5.28.5.
Jun 15, 2026Unauthenticated Bypass Vulnerability in Event Tickets <= 5.27.5 versions.CVE-2026-42662 · affects up to 5.27.5 · reported by PatchstackMedium 6.5
Unauthenticated Bypass Vulnerability in Event Tickets <= 5.27.5 versions.
Oct 22, 2025Event Tickets: Missing AuthorizationCVE-2025-62027 · affects up to 5.26.3 · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in StellarWP Event Tickets event-tickets.This issue affects Event Tickets: from n/a through <= 5.26.3.
Oct 18, 2025Event Tickets and Registration: Payment bypassCVE-2025-11517 · affects up to 5.26.5 · reported by WordfenceHigh 7.5
The Event Tickets and Registration plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 5.26.5. This is due to the /wp-json/tribe/tickets/v1/commerce/free/order endpoint not verifying that a ticket type should be free allowing the user to bypass the payment. This makes it possible for unauthenticated attackers to obtain access to paid tickets, without paying for them, causing a loss of revenue for the target.
Apr 1, 2025Event Tickets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30794 · affects up to 5.20.0 · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StellarWP Event Tickets event-tickets allows Reflected XSS.This issue affects Event Tickets: from n/a through <= 5.20.0.
Feb 21, 2025Event Tickets and Registration: Unauthorized loss of dataCVE-2025-1402 · affects up to 5.19.1.1 · reported by WordfenceMedium 5.3
The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'ajax_ticket_delete' function in all versions up to, and including, 5.19.1.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary Attendee tickets.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 30, 2025Event Tickets and Registration: Insecure Direct Object ReferenceCVE-2024-13457 · affects up to 5.18.1 · reported by WordfenceMedium 5.3
The Event Tickets and Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.18.1 via the tc-order-id parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view order details of orders they did not place, which includes ticket prices, user emails and order date.
Jan 2, 2025Event Tickets: Cross-Site Request Forgery (CSRF)CVE-2024-38762 · affects up to 5.11.0.4 · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in StellarWP Event Tickets event-tickets allows Cross Site Request Forgery.This issue affects Event Tickets: from n/a through <= 5.11.0.4.
Apr 9, 2024Event Tickets and Registration: Sensitive Information ExposureCVE-2024-2261 · affects up to 5.8.2 · reported by WordfenceMedium 4.3
The Event Tickets and Registration plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.8.2 via the RSVP functionality. This makes it possible for authenticated attackers, with contributor access and above, to extract sensitive data including emails and street addresses.
Feb 22, 2024Event Tickets and Registration: Unauthorized access of dataCVE-2024-1053 · affects up to 5.8.1 · reported by WordfenceMedium 4.3
The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'email' action in all versions up to, and including, 5.8.1. This makes it possible for authenticated attackers, with contributor-level access and above, to email the attendees list to themselves.
Jan 24, 2022Event Tickets: Does not validate the tribe_tickets_redirect_to parameter before redirecting the user to the given valueCVE-2021-25028 · fixed in 5.2.2 · reported by WPScanMedium 6.1
The Event Tickets WordPress plugin before 5.2.2 does not validate the tribe_tickets_redirect_to parameter before redirecting the user to the given value, leading to an arbitrary redirect issue
Sep 8, 2019CSV injection in the event-tickets (Event Tickets) plugin before 4.10.7.2 for WordPress exists via the "All Post> Ticketed > Attendees" Export Attendees featureCVE-2019-16120 · fixed in 4.10.7.2 · reported by MITREHigh 8.8
CSV injection in the event-tickets (Event Tickets) plugin before 4.10.7.2 for WordPress exists via the "All Post> Ticketed > Attendees" Export Attendees feature.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.