WordPress Event Tickets < 5.2.2 - Open Redirect

WordPress Event Tickets 5.2.2 is susceptible to an open redirect vulnerability. The plugin does not validate the tribeticketsredirectto parameter before redirecting the user to the given value, leading to an arbitrary redirect issue. id: CVE-2021-25028 info: name: WordPress Event Tickets 5.2.2 -...

CVE-2026-14822 Event Tickets < 5.29.0.1 - Unauthenticated PayPal Order Status Manipulation

The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not perform any authorization check on one of its order-management REST endpoints, allowing unauthenticated users to change the status of existing orders...

CVE-2026-14823

CVE-2026-14823 relates to the WordPress plugin Event Tickets and Registration prior to version 5.29.0.1. The issue is an authorization flaw in seating actions (IDOR-like behavior) that allows users with contributor-level access and above to overwrite the seating layout, ticket inventory, and atte...

PT-2026-65391

The Event Tickets and Registration WordPress plugin before 5.28.4 does not properly escape event titles before outputting them in a ticket history log, allowing users with the Editor role and above to perform Stored Cross-Site Scripting attacks that execute against higher-privileged users on...

CVE-2026-65567

The vulnerability concerns the WordPress Event Tickets plugin for WordPress, affected in versions ≤ 5.29.0.1. It is described as an Unauthenticated Broken Access Control flaw, meaning unauthenticated users can access restricted functionality or data. The CVE-2026-65567 entry confirms the issue wi...

CVE-2026-57705

CVE-2026-57705 affects the WordPress plugin Event Tickets (versions

CVE-2026-57705 WordPress Event Tickets plugin <= 5.28.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in Nexcess Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through = 5.28.5...

WordPress Event Tickets plugin <= 5.27.5 - Bypass Vulnerability vulnerability

Bypass Vulnerability vulnerability discovered by endy in WordPress Plugin Event Tickets versions = 5.27.5...

CVE-2019-16120

CSV injection in the event-tickets Event Tickets plugin before 4.10.7.2 for WordPress exists via the "All Post Ticketed Attendees" Export Attendees feature...

EUVD-2025-35381

Missing Authorization vulnerability in StellarWP Event Tickets event-tickets.This issue affects Event Tickets: from n/a through = 5.26.3...

CVE-2025-62027

Missing Authorization vulnerability in StellarWP Event Tickets event-tickets.This issue affects Event Tickets: from n/a through = 5.26.3...

CVE-2025-11517

CVE-2025-11517 affects the WordPress plugin “Event Tickets and Registration” (

WordPress Event Tickets and Registration plugin <= 5.26.5 - Unauthenticated Ticket Payment Bypass vulnerability

Unauthenticated Ticket Payment Bypass vulnerability discovered by Jack Pas Dark. in WordPress Plugin Event Tickets versions = 5.26.5...

EUVD-2021-11940

Malware in sbrugna...

EUVD-2024-16828

Malicious code in bioql PyPI...

EUVD-2025-8550

Malicious code in bioql PyPI...

EUVD-2024-51613

Malicious code in bioql PyPI...

PT-2025-40502

Name of the Vulnerable Software and Affected Versions Event Tickets, RSVPs, Calendar versions up to and including 1.0.2 Description The Event Tickets, RSVPs, Calendar plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'ticket spot' shortcode. This is due to inadequate...

CVE-2021-25028

The Event Tickets WordPress plugin before 5.2.2 does not validate the tribeticketsredirectto parameter before redirecting the user to the given value, leading to an arbitrary redirect issue...

CVE-2024-6711

The Event Tickets with Ticket Scanner WordPress plugin before 2.3.8 does not sanitise and escape some parameters, which could allow users with a role as low as admin to perform Cross-Site Scripting attacks...