Search

Find a vulnerability

Search criteria

    4 vulnerabilities found for Event Tickets with Ticket Scanner by Unknown

    CVE-2026-121858 (GCVE-0-2026-121858)

    Vulnerability from cvelistv5 – Published: 2026-11-07 06:00 – Updated: 2026-11-07 18:16
    VLAI
    Title
    Event Tickets with Ticket Scanner < 3.2.9 - Authenticated SQLi via DataTables Search
    Summary
    The Event Tickets with Ticket Scanner WordPress plugin before 3.2.9 does not properly escape a search value before using it in SQL queries in several of its admin listings, allowing users with access to its admin area (administrators by default, or any role granted access in its settings) to perform SQL injection attacks.
    Severity
    6.3 (Medium)
    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-11-07 18:01 UTC
    CWE
    Assigner
    WPScan CNA
    References
    URL Tags
    https://wpscan.com/vulnerability/8472ed42-2e1a-4e… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Event Tickets with Ticket Scanner Affected: 0 , < 3.2.9 (semver)
    		Create a notification for this product.
    Credits
    Mokksh Parekh WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-121858",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-07T18:01:05.165891Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-89",
                "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-07T18:16:14.642Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Event Tickets with Ticket Scanner",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "3.2.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mokksh Parekh"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Event Tickets with Ticket Scanner WordPress plugin before 3.2.9 does not properly escape a search value before using it in SQL queries in several of its admin listings, allowing users with access to its admin area (administrators by default, or any role granted access in its settings) to perform SQL injection attacks."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-89 SQL Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T06:00:29.004Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/8472ed42-2e1a-4efb-97b8-f01639772580/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Event Tickets with Ticket Scanner \u003c 3.2.9 - Authenticated SQLi via DataTables Search",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-121858",
    "datePublished": "2026-11-07T06:00:29.004Z",
    "dateReserved": "2026-11-04T09:23:13.992Z",
    "dateUpdated": "2026-11-07T18:16:14.642Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-121857 (GCVE-0-2026-121857)

    Vulnerability from cvelistv5 – Published: 2026-11-07 06:00 – Updated: 2026-11-07 18:16
    VLAI
    Title
    Event Tickets with Ticket Scanner < 3.1.14 - Authenticated Ticket Data Disclosure and Removal via executeWCBackend
    Summary
    The Event Tickets with Ticket Scanner WordPress plugin before 3.1.14 does not check that a user may manage WooCommerce orders before returning or removing ticket data for any order, allowing any role an administrator has granted access to the Event Tickets with Ticket Scanner WordPress plugin before 3.1.14's admin area (down to Subscriber) to view other customers' ticket codes and names and to remove tickets from their orders.
    Severity
    4.2 (Medium)
    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-11-07 18:01 UTC
    CWE
    Assigner
    WPScan CNA
    References
    URL Tags
    https://wpscan.com/vulnerability/5018fcfc-e8a3-4f… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Event Tickets with Ticket Scanner Affected: 0 , < 3.1.14 (semver)
    		Create a notification for this product.
    Credits
    Farid Narimanov WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.2,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-121857",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-07T18:01:16.814474Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-863",
                "description": "CWE-863 Incorrect Authorization",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-07T18:16:14.783Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Event Tickets with Ticket Scanner",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "3.1.14",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Farid Narimanov"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Event Tickets with Ticket Scanner WordPress plugin before 3.1.14 does not check that a user may manage WooCommerce orders before returning or removing ticket data for any order, allowing any role an administrator has granted access to the Event Tickets with Ticket Scanner WordPress plugin before 3.1.14\u0027s admin area (down to Subscriber) to view other customers\u0027 ticket codes and names and to remove tickets from their orders."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T06:00:27.713Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/5018fcfc-e8a3-4f52-bddb-fdff6990f382/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Event Tickets with Ticket Scanner \u003c 3.1.14 - Authenticated Ticket Data Disclosure and Removal via executeWCBackend",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-121857",
    "datePublished": "2026-11-07T06:00:27.713Z",
    "dateReserved": "2026-11-04T09:23:12.470Z",
    "dateUpdated": "2026-11-07T18:16:14.783Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2024-6711 (GCVE-0-2024-6711)

    Vulnerability from cvelistv5 – Published: 2025-05-15 20:09 – Updated: 2025-11-13 20:59
    VLAI
    Title
    Event Tickets with Ticket Scanner < 2.3.8 - Admin+ Stored XSS
    Summary
    The Event Tickets with Ticket Scanner WordPress plugin before 2.3.8 does not sanitise and escape some parameters, which could allow users with a role as low as admin to perform Cross-Site Scripting attacks
    Severity
    3.5 (Low)
    CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
    SSVC
    Exploitation: poc Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2025-05-16 15:15 UTC
    CWE
    Assigner
    WPScan CNA
    References
    URL Tags
    https://wpscan.com/vulnerability/bf431b81-2db9-4f… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Event Tickets with Ticket Scanner Affected: 0 , < 2.3.8 (semver)
    		Create a notification for this product.
    Credits
    Anas Jamal and Satyam Singh WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 3.5,
              "baseSeverity": "LOW",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-6711",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-16T15:15:58.722748Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-11-13T20:59:18.331Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Event Tickets with Ticket Scanner",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "2.3.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Anas Jamal and Satyam Singh"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Event Tickets with Ticket Scanner WordPress plugin before 2.3.8 does not sanitise and escape some parameters, which could allow users with a role as low as admin to perform Cross-Site Scripting attacks"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-79 Cross-Site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-15T20:09:46.782Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/bf431b81-2db9-4fcb-841c-9b51d1870bf8/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Event Tickets with Ticket Scanner \u003c 2.3.8 - Admin+ Stored XSS",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2024-6711",
    "datePublished": "2025-05-15T20:09:46.782Z",
    "dateReserved": "2024-07-12T13:00:35.770Z",
    "dateUpdated": "2025-11-13T20:59:18.331Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2025-1762 (GCVE-0-2025-1762)

    Vulnerability from cvelistv5 – Published: 2025-03-28 06:00 – Updated: 2025-03-28 14:43
    VLAI
    Title
    Event Tickets with Ticket Scanner < 2.5.4 - Arbitrary Tickets Deletion via CSRF
    Summary
    The Event Tickets with Ticket Scanner WordPress plugin before 2.5.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
    Severity
    4.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
    SSVC
    Exploitation: poc Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2025-03-28 14:42 UTC
    CWE
    Assigner
    WPScan CNA
    References
    URL Tags
    https://wpscan.com/vulnerability/d5cefdee-2ba0-46… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Event Tickets with Ticket Scanner Affected: 0 , < 2.5.4 (semver)
    		Create a notification for this product.
    Credits
    Krugov Artyom WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-1762",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-28T14:42:55.499666Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-28T14:43:22.369Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://wpscan.com/vulnerability/d5cefdee-2ba0-465d-b176-0dff39fc322c/"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Event Tickets with Ticket Scanner",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "2.5.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Krugov Artyom"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Event Tickets with Ticket Scanner WordPress plugin before 2.5.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-28T06:00:03.726Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/d5cefdee-2ba0-465d-b176-0dff39fc322c/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Event Tickets with Ticket Scanner \u003c 2.5.4 - Arbitrary Tickets Deletion via CSRF",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2025-1762",
    "datePublished": "2025-03-28T06:00:03.726Z",
    "dateReserved": "2025-02-27T16:54:35.654Z",
    "dateUpdated": "2025-03-28T14:43:22.369Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}