Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
254 results · page 3 of 6
May 10, 2026uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the tickets/manage module.CVE-2022-50967 · Other software · uBidAuction · reported by VulnCheckMedium 5.1
uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the tickets/manage module. The date_created, date_from, date_to, and created_at parameters in the filter functionality are not properly sanitized, allowing remote attackers to inject malicious scripts via crafted GET requests that execute in victims' browsers.
- Product
- uBidAuction
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordapphp.comexploit-db.com
May 4, 2026The Easy PayPal Events & Tickets plugin for WordPress before version 1.4 contains an information disclosure vulnerability in the QR code scanning endpoint that CVE-2026-41471 · WordPress plugins & themes · reported by VulnCheckHigh 8.2
The Easy PayPal Events & Tickets plugin for WordPress before version 1.4 contains an information disclosure vulnerability in the QR code scanning endpoint that allows unauthenticated attackers to enumerate and retrieve all customer order records. Attackers can iterate over sequential WordPress post IDs through the scan_qr.php endpoint to harvest the complete set of orders stored in the database without requiring authentication or prior knowledge of specific order identifiers.
- Product
- Easy PayPal Events & Tickets
- What to do
- Update Easy PayPal Events & Tickets to the newest version.
Full record and what to do →NVD recordgist.github.comwordpress.org
May 4, 2026the QR code scanning functionality that: Easy PayPal Events & Tickets plugin for WordPress before version 1.4 contains a hardcoded authentication bypassCVE-2026-32834 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
Easy PayPal Events & Tickets plugin for WordPress before version 1.4 contains a hardcoded authentication bypass vulnerability in the QR code scanning functionality that allows unauthenticated remote attackers to bypass hash verification by supplying 'test' as the hash parameter. Attackers can access the vulnerable endpoint via the add_wpeevent_button_qr action to retrieve sensitive order details including PayPal transaction IDs, customer email addresses, purchase amounts, and ticket information for any order with a known or guessed post ID.
- Product
- the QR code scanning functionality that
- What to do
- Update the QR code scanning functionality that to the newest version.
Full record and what to do →NVD recordgist.github.comwordpress.org
Apr 24, 2026In the Linux kernel, the following vulnerability has been resolved: rxrpc: reject undecryptable rxkad response tickets rxkad_decrypt_ticket() decrypts the RXKCVE-2026-31637 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Critical 9.8
In the Linux kernel, the following vulnerability has been resolved: rxrpc: reject undecryptable rxkad response tickets rxkad_decrypt_ticket() decrypts the RXKAD response ticket and then parses the buffer as plaintext without checking whether crypto_skcipher_decrypt() succeeded. A malformed RESPONSE can therefore use a non-block-aligned ticket length, make the decrypt operation fail, and still drive the ticket parser with attacker-controlled bytes. Check the decrypt result and abort the connection with RXKADBADTICKET when ticket decryption fails.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Mar 25, 2026My Tickets: Authentication Bypass by SpoofingCVE-2026-32492 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authentication Bypass by Spoofing vulnerability in Joe Dolson My Tickets my-tickets allows Identity Spoofing.This issue affects My Tickets: from n/a through <= 2.1.1.
- Product
- My Tickets
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update My Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026My Tickets: Insertion of Sensitive Information Into Sent DataCVE-2026-27406 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Insertion of Sensitive Information Into Sent Data vulnerability in Joe Dolson My Tickets my-tickets allows Retrieve Embedded Sensitive Data.This issue affects My Tickets: from n/a through <= 2.1.0.
- Product
- My Tickets
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update My Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 27, 2026Improper Input Validation vulnerability in Centreon Centreon Open Tickets on Central Server on Linux (Centreon Open Tickets modules).This issue affects CentreonCVE-2026-2750 · Other software · Centreon · reported by bd4443e6-1eef-43f3-9886-25fc9ceeaae7Critical 9.1
Improper Input Validation vulnerability in Centreon Centreon Open Tickets on Central Server on Linux (Centreon Open Tickets modules).This issue affects Centreon Open Tickets on Central Server: from all before 25.10; 24.10;24.04.
- Product
- Centreon Open Tickets on Central Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2026Vulnerability in Centreon Centreon Open Tickets on Central Server on Linux (Centroen Open Ticket modules).This issue affects Centreon Open Tickets on Central SeCVE-2026-2749 · Other software · Centreon · reported by bd4443e6-1eef-43f3-9886-25fc9ceeaae7Critical 9.9
Vulnerability in Centreon Centreon Open Tickets on Central Server on Linux (Centroen Open Ticket modules).This issue affects Centreon Open Tickets on Central Server: from all before 25.10.3, 24.10.8, 24.04.7.
- Product
- Open Tickets
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2026The SPIP tickets plugin versions prior to 4.3.3 contain an unauthenticated remote code execution vulnerability in the forum preview handling for public ticket pCVE-2026-27744 · Other software · SPIP · reported by VulnCheckCritical 9.3
The SPIP tickets plugin versions prior to 4.3.3 contain an unauthenticated remote code execution vulnerability in the forum preview handling for public ticket pages. The plugin appends untrusted request parameters into HTML that is later rendered by a template using unfiltered environment rendering (#ENV**), which disables SPIP output filtering. As a result, an unauthenticated attacker can inject crafted content that is evaluated through SPIP's template processing chain, leading to execution of code in the context of the web server.
- Product
- tickets
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.spip.netchocapikk.com
Feb 18, 2026Tickera – Sell Tickets & Manage Events: Unauthorized modification of dataCVE-2025-12356 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_change_ticket_status' AJAX endpoint in all versions up to, and including, 3.5.6.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update post/event statuses.
- Product
- Tickera – Sell Tickets & Manage Events
- Affected
- up to 3.5.6.4
- What to do
- Affects up to 3.5.6.4. Update Tickera – Sell Tickets & Manage Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 22, 2026Event Tickets with Ticket Scanner: Improper Control of Generation of Code ('Code Injection')CVE-2025-68015 · WordPress plugins & themes · reported by PatchstackCritical 9
Improper Control of Generation of Code ('Code Injection') vulnerability in Vollstart Event Tickets with Ticket Scanner event-tickets-with-ticket-scanner allows Code Injection.This issue affects Event Tickets with Ticket Scanner: from n/a through <= 2.8.5.
- Product
- Event Tickets with Ticket Scanner
- Affected
- up to 2.8.5
- What to do
- Affects up to 2.8.5. Update Event Tickets with Ticket Scanner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 13, 2026EventPrime - Events Calendar, Bookings and Tickets: Sensitive Information ExposureCVE-2025-14507 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The EventPrime - Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.7.0 via the REST API. This makes it possible for unauthenticated attackers to extract sensitive booking data including user names, email addresses, ticket details, payment information, and order keys when the API is enabled by an administrator. The vulnerability was partially patched in version 4.2.7.0.
- Product
- EventPrime - Events Calendar, Bookings and Tickets
- Affected
- up to 4.2.7.0
- What to do
- Affects up to 4.2.7.0. Update EventPrime - Events Calendar, Bookings and Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 9, 2026Eventin – Event Manager, Events Calendar, Event Tickets and Registrations: Unauthorized modification of dataCVE-2025-14657 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Eventin – Event Manager, Events Calendar, Event Tickets and Registrations plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'post_settings' function in all versions up to, and including, 4.0.51. This makes it possible for unauthenticated attackers to modify plugin settings. Furthermore, due to insufficient input sanitization and output escaping on the 'etn_primary_color' setting, this enables unauthenticated attackers to inject arbitrary web scripts that will execute whenever a user accesses a page where Eventin styles are loaded.
- Product
- Eventin – Event Manager, Events Calendar, Event Tickets and Registrations
- Affected
- up to 4.0.51
- What to do
- Affects up to 4.0.51. Update Eventin – Event Manager, Events Calendar, Event Tickets and Registrations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 22, 2025Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon Infra Monitoring - Open-tickets (Notification rulCVE-2025-12514 · Other software · Centreon · reported by bd4443e6-1eef-43f3-9886-25fc9ceeaae7High 7.2
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon Infra Monitoring - Open-tickets (Notification rules configuration parameters, Open tickets modules) allows SQL Injection to user with elevated privileges.This issue affects Infra Monitoring - Open-tickets: from 24.10.0 before 24.10.5, from 24.04.0 before 24.04.5, from 23.10.0 before 23.10.4.
- Product
- Infra Monitoring - Open-tickets
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comthewatch.centreon.com
Dec 18, 2025Events Manager – Calendar, Bookings, Tickets, and more!: Stored Cross-Site ScriptingCVE-2025-12976 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'events_list_grouped' shortcode in all versions up to, and including, 7.2.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Events Manager – Calendar, Bookings, Tickets, and more!
- Affected
- up to 7.2.2.1
- What to do
- Affects up to 7.2.2.1. Update Events Manager – Calendar, Bookings, Tickets, and more! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 12, 2025Events Manager – Calendar, Bookings, Tickets, and more!: Information ExposureCVE-2025-12408 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 7.2.2.2 via the 'get_location' action due to insufficient restrictions on which locations can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft event locations that they should not have access to.
- Product
- Events Manager – Calendar, Bookings, Tickets, and more!
- Affected
- up to 7.2.2.2
- What to do
- Affects up to 7.2.2.2. Update Events Manager – Calendar, Bookings, Tickets, and more! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 12, 2025Events Manager – Calendar, Bookings, Tickets, and more!: Cross-Site Request ForgeryCVE-2025-12407 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.2.2.2. This is due to missing or incorrect nonce validation on the 'location_delete' action. This makes it possible for unauthenticated attackers to delete locations via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Events Manager – Calendar, Bookings, Tickets, and more!
- Affected
- up to 7.2.2.2
- What to do
- Affects up to 7.2.2.2. Update Events Manager – Calendar, Bookings, Tickets, and more! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 9, 2025My Tickets: Missing AuthorizationCVE-2025-64257 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Joe Dolson My Tickets my-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My Tickets: from n/a through <= 2.1.0.
- Product
- My Tickets
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update My Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 8, 2025EventPrime – Events Calendar, Bookings and Tickets: Unauthorized booking note creationCVE-2025-12498 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized booking note creation due to a missing capability check on the 'booking_add_notes' function in all versions up to, and including, 4.2.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add a note to the backend view of any booking.
- Product
- EventPrime – Events Calendar, Bookings and Tickets
- Affected
- up to 4.2.0.0
- What to do
- Affects up to 4.2.0.0. Update EventPrime – Events Calendar, Bookings and Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 22, 2025Event Tickets: Missing AuthorizationCVE-2025-62027 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in StellarWP Event Tickets event-tickets.This issue affects Event Tickets: from n/a through <= 5.26.3.
- Product
- Event Tickets
- Affected
- up to 5.26.3
- What to do
- Affects up to 5.26.3. Update Event Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2025Event Tickets and Registration: Payment bypassCVE-2025-11517 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Event Tickets and Registration plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 5.26.5. This is due to the /wp-json/tribe/tickets/v1/commerce/free/order endpoint not verifying that a ticket type should be free allowing the user to bypass the payment. This makes it possible for unauthenticated attackers to obtain access to paid tickets, without paying for them, causing a loss of revenue for the target.
- Product
- Event Tickets and Registration
- Affected
- up to 5.26.5
- What to do
- Affects up to 5.26.5. Update Event Tickets and Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 3, 2025The endpoint POST /api/staff/get-new-tickets concatenates the user-controlled parameter departmentId directly into the SQL WHERE clause without parameter bindinCVE-2025-10692 · Other software · OpenSupports · reported by help@fluidattacks.comHigh 7.1
The endpoint POST /api/staff/get-new-tickets concatenates the user-controlled parameter departmentId directly into the SQL WHERE clause without parameter binding. As a result, an authenticated staff user (level ≥ 1) can inject SQL to alter the filter logic, effectively bypassing department scoping and disclosing tickets beyond their intended access.This issue affects OpenSupports: 4.11.0.
- Product
- OpenSupports
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Oct 3, 2025Event Tickets, RSVPs, Calendar: Stored Cross-Site ScriptingCVE-2025-9875 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Event Tickets, RSVPs, Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ticket_spot' shortcode in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Event Tickets, RSVPs, Calendar
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Event Tickets, RSVPs, Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 9, 2025My Tickets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58988 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joe Dolson My Tickets my-tickets allows Stored XSS.This issue affects My Tickets: from n/a through <= 2.0.22.
- Product
- My Tickets
- Affected
- up to 2.0.22
- What to do
- Affects up to 2.0.22. Update My Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 23, 2025Events Calendar, Event Booking, Registrations and Event Tickets – Eventin: Server-Side Request ForgeryCVE-2025-7813 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Events Calendar, Event Booking, Registrations and Event Tickets – Eventin plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.0.37 via the proxy_image function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
- Product
- Events Calendar, Event Booking, Registrations and Event Tickets – Eventin
- Affected
- up to 4.0.37
- What to do
- Affects up to 4.0.37. Update Events Calendar, Event Booking, Registrations and Event Tickets – Eventin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 16, 2025WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce: Stored Cross-Site ScriptingCVE-2025-2800 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘organizer_name' parameter in all versions up to, and including, 3.1.50 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce
- Affected
- up to 3.1.50
- What to do
- Affects up to 3.1.50. Update WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 16, 2025WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce: Stored Cross-Site ScriptingCVE-2025-2799 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tag-name’ parameter in all versions up to, and including, 3.1.49 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce
- Affected
- up to 3.1.49
- What to do
- Affects up to 3.1.49. Update WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 9, 2025Events Manager – Calendar, Bookings, Tickets, and more!: Stored Cross-Site ScriptingCVE-2025-6976 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 7.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Events Manager – Calendar, Bookings, Tickets, and more!
- Affected
- up to 7.0.3
- What to do
- Affects up to 7.0.3. Update Events Manager – Calendar, Bookings, Tickets, and more! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 9, 2025Events Manager – Calendar, Bookings, Tickets, and more!: Reflected Cross-Site ScriptingCVE-2025-6975 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘calendar_header’ parameter in all versions up to, and including, 7.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Events Manager – Calendar, Bookings, Tickets, and more!
- Affected
- up to 7.0.3
- What to do
- Affects up to 7.0.3. Update Events Manager – Calendar, Bookings, Tickets, and more! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 9, 2025Events Manager – Calendar, Bookings, Tickets, and more!: Time-based SQL InjectionCVE-2025-6970 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 7.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Events Manager – Calendar, Bookings, Tickets, and more!
- Affected
- up to 7.0.3
- What to do
- Affects up to 7.0.3. Update Events Manager – Calendar, Bookings, Tickets, and more! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 11, 2025A stored XSS vulnerability in RSTickets! component 1.9.12 - 3.3.0 for Joomla was discovered.CVE-2025-32465 · Other software · rsjoomla.com · reported by security@joomla.orgHigh 8.5
A stored XSS vulnerability in RSTickets! component 1.9.12 - 3.3.0 for Joomla was discovered. It allows attackers to perform cross-site scripting (XSS) attacks via sending crafted payload.
- Product
- RSTickets! component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2025WordPress Events Calendar Registration & Tickets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39372 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in elbisnero WordPress Events Calendar Registration & Tickets wpeventplus allows Reflected XSS.This issue affects WordPress Events Calendar Registration & Tickets: from n/a through <= 2.6.0.
- Product
- WordPress Events Calendar Registration & Tickets
- Affected
- up to 2.6.0
- What to do
- Affects up to 2.6.0. Update WordPress Events Calendar Registration & Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025WordPress Events Calendar Registration & Tickets: Deserialization of Untrusted DataCVE-2025-47581 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in elbisnero WordPress Events Calendar Registration & Tickets wpeventplus allows Object Injection.This issue affects WordPress Events Calendar Registration & Tickets: from n/a through <= 2.6.0.
- Product
- WordPress Events Calendar Registration & Tickets
- Affected
- up to 2.6.0
- What to do
- Affects up to 2.6.0. Update WordPress Events Calendar Registration & Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Event Tickets with Ticket Scanner: Does not sanitise and escape some parametersCVE-2024-6711 · WordPress plugins & themes · reported by WPScanLow 3.5
The Event Tickets with Ticket Scanner WordPress plugin before 2.3.8 does not sanitise and escape some parameters, which could allow users with a role as low as admin to perform Cross-Site Scripting attacks
- Product
- Event Tickets with Ticket Scanner
- Fixed in
- 2.3.8
- What to do
- Update Event Tickets with Ticket Scanner to 2.3.8 or newer.
May 8, 2025Event Manager, Events Calendar, Tickets, Registrations – Eventin: Arbitrary file readCVE-2025-3419 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 4.0.26 via the proxy_image() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. CVE-2025-47445 is a duplicate of this vulnerability.
- Product
- Event Manager, Events Calendar, Tickets, Registrations – Eventin
- Affected
- up to 4.0.26
- What to do
- Affects up to 4.0.26. Update Event Manager, Events Calendar, Tickets, Registrations – Eventin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 5, 2025A SQL injection vulnerability in the "Search" functionality of "tickets.php" page in osTicket <=1.17.5 allows authenticated attackers to execute arbitrary SQL cCVE-2025-26241 · Other software · Enhancesoft · reported by MITREMedium 6.5
A SQL injection vulnerability in the "Search" functionality of "tickets.php" page in osTicket <=1.17.5 allows authenticated attackers to execute arbitrary SQL commands via the "keywords" and "topic_id" URL parameters combination.
- Product
- Osticket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2025My Tickets – Accessible Event Ticketing: Privilege EscalationCVE-2025-3761 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The My Tickets – Accessible Event Ticketing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.16. This is due to the mt_save_profile() function not appropriately restricting access to unauthorized users to update roles. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update their role to that of an administrator.
- Product
- My Tickets – Accessible Event Ticketing
- Affected
- up to 2.0.16
- What to do
- Affects up to 2.0.16. Update My Tickets – Accessible Event Ticketing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 1, 2025Event Tickets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30794 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StellarWP Event Tickets event-tickets allows Reflected XSS.This issue affects Event Tickets: from n/a through <= 5.20.0.
- Product
- Event Tickets
- Affected
- up to 5.20.0
- What to do
- Affects up to 5.20.0. Update Event Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 28, 2025Event Tickets with Ticket Scanner: Does not have CSRF check in placeCVE-2025-1762 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Event Tickets with Ticket Scanner WordPress plugin before 2.5.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Event Tickets with Ticket Scanner
- Fixed in
- 2.5.4
- What to do
- Update Event Tickets with Ticket Scanner to 2.5.4 or newer.
Mar 20, 2025Event Manager, Events Calendar, Tickets, Registrations – Eventin: Local File InclusionCVE-2025-1770 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.0.24 via the 'style' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
- Product
- Event Manager, Events Calendar, Tickets, Registrations – Eventin
- Affected
- up to 4.0.24
- What to do
- Affects up to 4.0.24. Update Event Manager, Events Calendar, Tickets, Registrations – Eventin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 20, 2025Event Manager, Events Calendar, Tickets, Registrations – Eventin: Unauthorized modification of dataCVE-2025-1766 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'payment_complete' function in all versions up to, and including, 4.0.24. This makes it possible for unauthenticated attackers to update the status of ticket payments to 'completed', possibly resulting in financial loss.
- Product
- Event Manager, Events Calendar, Tickets, Registrations – Eventin
- Affected
- up to 4.0.24
- What to do
- Affects up to 4.0.24. Update Event Manager, Events Calendar, Tickets, Registrations – Eventin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 6, 2025EventPrime – Events Calendar, Bookings and Tickets: Unauthorized access of dataCVE-2024-13526 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability checks on the export_submittion_attendees function in all versions up to, and including, 4.0.7.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to download list of attendees for any event.
- Product
- EventPrime – Events Calendar, Bookings and Tickets
- Affected
- up to 4.0.7.3
- What to do
- Affects up to 4.0.7.3. Update EventPrime – Events Calendar, Bookings and Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 21, 2025Event Tickets and Registration: Unauthorized loss of dataCVE-2025-1402 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'ajax_ticket_delete' function in all versions up to, and including, 5.19.1.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary Attendee tickets.
- Product
- Event Tickets and Registration
- Affected
- up to 5.19.1.1
- What to do
- Affects up to 5.19.1.1. Update Event Tickets and Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 21, 2025Events Manager – Calendar, Bookings, Tickets, and more!: Time-based SQL InjectionCVE-2024-11260 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the active_status parameter in all versions up to, and including, 6.6.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Events Manager – Calendar, Bookings, Tickets, and more!
- Affected
- up to 6.6.3
- What to do
- Affects up to 6.6.3. Update Events Manager – Calendar, Bookings, Tickets, and more! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 31, 2025Ticketmeo – Sell Tickets – Event Ticketing: Stored Cross-Site ScriptingCVE-2025-0507 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ticketmeo – Sell Tickets – Event Ticketing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 2.3.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Ticketmeo – Sell Tickets – Event Ticketing
- Affected
- up to 2.3.6
- What to do
- Affects up to 2.3.6. Update Ticketmeo – Sell Tickets – Event Ticketing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 30, 2025Event Tickets and Registration: Insecure Direct Object ReferenceCVE-2024-13457 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Event Tickets and Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.18.1 via the tc-order-id parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view order details of orders they did not place, which includes ticket prices, user emails and order date.
- Product
- Event Tickets and Registration
- Affected
- up to 5.18.1
- What to do
- Affects up to 5.18.1. Update Event Tickets and Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 21, 2025My Tickets: Missing AuthorizationCVE-2025-22717 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Joe Dolson My Tickets my-tickets allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects My Tickets: from n/a through <= 2.0.9.
- Product
- My Tickets
- Affected
- up to 2.0.9
- What to do
- Affects up to 2.0.9. Update My Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 13, 2025Event Monster – Event Management, Tickets Booking, Upcoming Event: Information ExposureCVE-2024-11396 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Event Monster – Event Management, Tickets Booking, Upcoming Event plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4.3 via the Visitors List Export file. During the export, a CSV file is created in the wp-content folder with a hardcoded filename that is publicly accessible. This makes it possible for unauthenticated attackers to extract data about event visitors, that includes first and last names, email, and phone number.
- Product
- Event Monster – Event Management, Tickets Booking, Upcoming Event
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update Event Monster – Event Management, Tickets Booking, Upcoming Event to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 2, 2025Event Tickets: Cross-Site Request Forgery (CSRF)CVE-2024-38762 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in StellarWP Event Tickets event-tickets allows Cross Site Request Forgery.This issue affects Event Tickets: from n/a through <= 5.11.0.4.
- Product
- Event Tickets
- Affected
- up to 5.11.0.4
- What to do
- Affects up to 5.11.0.4. Update Event Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 20, 2024Sell Tickets Online – TicketSource Ticket Shop for: Stored Cross-Site ScriptingCVE-2024-11784 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Sell Tickets Online – TicketSource Ticket Shop for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ticketshop' shortcode in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Sell Tickets Online – TicketSource Ticket Shop for
- Affected
- up to 3.0.2
- What to do
- Affects up to 3.0.2. Update Sell Tickets Online – TicketSource Ticket Shop for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.