CVE-2021-24796

🗓️ 17 Nov 2021 10:15:40Reported by WPScanType

cve🔗 web.nvd.nist.gov👁 41 Views🌐 WEB

The My Tickets WordPress plugin before 1.8.31 allows unauthenticated users to perform Cross-Site Scripting attacks against admins

Reporter	Title	Published	Views	Family All 10
CNNVD	WordPress 跨站脚本漏洞	17 Nov 202100:00	–	cnnvd
CNVD	WordPress My Tickets plugin cross-site scripting vulnerability	21 Nov 202100:00	–	cnvd
Cvelist	CVE-2021-24796 My Tickets < 1.8.31 - Unauthenticated Stored Cross-Site Scripting	17 Nov 202110:15	–	cvelist
NVD	CVE-2021-24796	17 Nov 202111:15	–	nvd
OSV	CVE-2021-24796	17 Nov 202111:15	–	osv
Patchstack	WordPress My Tickets plugin <= 1.8.30 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability	18 Oct 202100:00	–	patchstack
Prion	Cross site scripting	17 Nov 202111:15	–	prion
RedhatCVE	CVE-2021-24796	22 May 202519:23	–	redhatcve
wpexploit	My Tickets < 1.8.31 - Unauthenticated Stored Cross-Site Scripting	18 Oct 202100:00	–	wpexploit
WPVulnDB	My Tickets < 1.8.31 - Unauthenticated Stored Cross-Site Scripting	18 Oct 202100:00	–	wpvulndb

NVD

Vulners

Node

my_tickets_project my_ticketsRange<1.8.31wordpress

[
  {
    "product": "My Tickets",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "1.8.31",
        "status": "affected",
        "version": "1.8.31",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/d973dc0f-3cb4-408d-a8b0-01abeb9ef951

Parameter	Position	Path	Description	CWE
mt_email	request body	purchase/	XSS via unescaped Email field submitted during purchase	CWE-79
mt_email2	request body	purchase/	XSS via unescaped Email field submitted during purchase	CWE-79

17 Jun 2026 03:40Current

6Medium risk

Vulners AI Score6

CVSS 24.3

CVSS 3.16.1

EPSS0.01167

CWE-79

cve-2021-24796 my tickets wordpress plugin unauthenticated users cross-site scripting xss admin dashboard