Event Tickets Plus < 5.9.1 - Contributor+ Attendees Lists Disclosure

Description The plugin does not prevent users with at least the contributor role from leaking the attendees list on any post type regardless of status. e.g. draft, private, pending review, password-protected, and trashed posts. PoC 1. ADMIN: Install Event Tickets 2. ADMIN: Install Event Tickets...

Event Tickets and Registration < 5.8.1 - Contributor+ Arbitrary Events Access

Description The plugin does not prevent users with at least the contributor role from leaking the existence of certain events they shouldn't have access to. e.g. draft, private, pending review, pw-protected, and trashed events. 1. ADMIN: Install Event Tickets 2. ADMIN: Install Event Tickets Plus...

Event Tickets Plus < 5.9.1 - Contributor+ Attendees Lists Disclosure

Description The plugin does not prevent users with at least the contributor role from leaking the attendees list on any post type regardless of status. e.g. draft, private, pending review, password-protected, and trashed posts. 1. ADMIN: Install Event Tickets 2. ADMIN: Install Event Tickets Plus ...

WordPress Event Tickets with Ticket Scanner Plugin < 1.5.5 is vulnerable to Cross Site Scripting (XSS)

Software Event Tickets with Ticket Scanner Type Plugin Vulnerable versions 1.5.5 Fixed in 1.5.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID daa37a82b56a Credits Unknown...

WordPress Event Tickets Plugin <= 5.5.11.1 is vulnerable to Cross Site Scripting (XSS)

Software Event Tickets Type Plugin Vulnerable versions = 5.5.11.1 Fixed in 5.6.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority High CVSS severity High 7.1 Developer Liquid Web / StellarWP PSID b526dab2f64a Credits Rafie Muhammad Patchstack...

vienna-event-tickets.com Cross Site Scripting vulnerability OBB-3251439

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

WordPress Event Tickets plugin < 5.3.0.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Event Tickets plugin versions 5.3.0.1. Solution Update the WordPress Event Tickets plugin to the latest available version at least 5.3.0.1...

WordPress Event Tickets plugin < 5.3.0.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Event Tickets plugin versions 5.3.0.1. Solution Update the WordPress Event Tickets plugin to the latest available version at least 5.3.0.1...

CVE-2021-25028

The Event Tickets WordPress plugin before 5.2.2 does not validate the tribeticketsredirectto parameter before redirecting the user to the given value, leading to an arbitrary redirect issue...

CVE-2021-25028

The Event Tickets WordPress plugin before 5.2.2 does not validate the tribeticketsredirectto parameter before redirecting the user to the given value, leading to an arbitrary redirect issue...

CVE-2021-25028

The Event Tickets WordPress plugin before 5.2.2 does not validate the tribeticketsredirectto parameter before redirecting the user to the given value, leading to an arbitrary redirect issue...

Crlf injection

The Event Tickets WordPress plugin before 5.2.2 does not validate the tribeticketsredirectto parameter before redirecting the user to the given value, leading to an arbitrary redirect issue...

CVE-2021-25028

Summary: CVE-2021-25028 affects the WordPress Event Tickets plugin up to version 5.2.1 (before 5.2.2). The vulnerability is an open redirect: the plugin does not validate the tribe_tickets_redirect_to parameter before redirecting, enabling arbitrary redirects. The issue is documented across multi...

CVE-2021-25028 Event Tickets < 5.2.2 - Open Redirect

The Event Tickets WordPress plugin before 5.2.2 does not validate the tribeticketsredirectto parameter before redirecting the user to the given value, leading to an arbitrary redirect issue...

WordPress plugin 输入验证错误漏洞

WordPress plugin is an open source application plugin for WordPress. WordPress plugin Event Tickets plugin version prior to 5.2.2 has an input validation error vulnerability The plugin does not validate the tribeTicketsredirectto parameter before redirecting the user to a given value...

CVE-2021-25028: URL Redirection to Untrusted Site

The Event Tickets WordPress plugin before 5.2.2 does not validate the tribeticketsredirectto parameter before redirecting the user to the given value, leading to an arbitrary redirect issue...

PT-2022-9585

Name of the Vulnerable Software and Affected Versions Event Tickets WordPress plugin versions prior to 5.2.2 Description The issue arises from the lack of validation of the tribe tickets redirect to parameter, which allows for an arbitrary redirect. This could potentially be exploited to redirect...

Event Tickets < 5.2.2 - Open Redirect

The plugin does not validate the tribeticketsredirectto parameter before redirecting the user to the given value, leading to an arbitrary redirect issue https://exampel.com/wp-admin/admin.php?page=wpajaxrsvp-form&tribeticketsredirectto=https://wpscan.com...

Event Tickets < 5.2.2 - Open Redirect

The plugin does not validate the tribeticketsredirectto parameter before redirecting the user to the given value, leading to an arbitrary redirect issue PoC https://exampel.com/wp-admin/admin.php?page=wpajaxrsvp-formticketsredirectto=https://wpscan.com...

WordPress Event Tickets plugin <= 5.2.1 - Open Redirect vulnerability

Open Redirect vulnerability discovered in WordPress Event Tickets plugin versions = 5.2.1. Solution Update the WordPress Event Tickets plugin to the latest available version at least 5.2.2...