Unknown Event Tickets And Registration vulnerabilities

4 vulnerabilities

Known vulnerabilities in Unknown Event Tickets And Registration, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

6.5CVE-2024-1316liquidwebevent_tickets+4
EPSS score
0.60%
The Event Tickets and Registration WordPress plugin before 5.8.1, Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the contributor role from leaking the existence of certain events they shouldn't have access to. (e.g. draft, private, pending review, pw-protected, and trashed events).5.3CVE-2026-14822unknownevent tickets and registration+1
EPSS score
0.30%
The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not perform any authorization check on one of its order-management REST endpoints, allowing unauthenticated users to change the status of existing orders.4.4CVE-2026-14819unknownevent tickets and registration+1
EPSS score
0.24%
The Event Tickets and Registration WordPress plugin before 5.28.4 does not properly escape event titles before outputting them in a ticket history log, allowing users with the Editor role and above to perform Stored Cross-Site Scripting attacks that execute against higher-privileged users on multisite installations.4.3CVE-2026-14823unknownevent tickets and registration+1
EPSS score
0.23%
The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not properly verify authorization on some of its seating actions, allowing users with contributor-level access and above to overwrite the seating layout, ticket inventory, and attendee seat assignments of events they do not own.