CVE-2026-32834: Use of Hard-coded Credentials

Easy PayPal Events & Tickets plugin for WordPress version 1.3 and earlier contain a hardcoded authentication bypass vulnerability in the QR code scanning functionality that allows unauthenticated remote attackers to bypass hash verification by supplying 'test' as the hash parameter. Attackers can...

CVE-2026-41471: Authorization Bypass Through User-Controlled Key

The Easy PayPal Events & Tickets plugin for WordPress before version 1.4 contains an information disclosure vulnerability in the QR code scanning endpoint that allows unauthenticated attackers to enumerate and retrieve all customer order records. Attackers can iterate over sequential WordPress po...

EUVD-2024-17077

Malicious code in bioql PyPI...

CVE-2024-1319

The Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the contributor role from leaking the attendees list on any post type regardless of status. e.g. draft, private, pending review, password-protected, and trashed posts...

WordPress Events Tickets Plus Plugin < 5.9.1 is vulnerable to Broken Access Control

Software Events Tickets Plus Type Plugin Vulnerable versions 5.9.1 Fixed in 5.9.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-1316 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 2dfabd1f95ab Credits Scott Kingsley Clark Require...

WordPress Events Tickets Plus Plugin < 5.9.1 is vulnerable to Broken Access Control

Software Events Tickets Plus Type Plugin Vulnerable versions 5.9.1 Fixed in 5.9.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-1319 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID b382e64c9059 Credits Scott Kingsley Clark Require...

CVE-2024-1316

The Event Tickets and Registration WordPress plugin before 5.8.1, Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the contributor role from leaking the existence of certain events they shouldn't have access to. e.g. draft, private, pending review,...

CVE-2024-1319

The Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the contributor role from leaking the attendees list on any post type regardless of status. e.g. draft, private, pending review, password-protected, and trashed posts...

Default credentials

The Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the contributor role from leaking the attendees list on any post type regardless of status. e.g. draft, private, pending review, password-protected, and trashed posts...

CVE-2024-1319: Undefined Security Weakness

The Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the contributor role from leaking the attendees list on any post type regardless of status. e.g. draft, private, pending review, password-protected, and trashed posts...

PT-2024-17939

Name of the Vulnerable Software and Affected Versions Events Tickets Plus WordPress plugin versions prior to 5.9.1 Description The issue allows users with at least the contributor role to leak the attendees list on any post type, regardless of its status, such as draft, private, pending review,...

CVE-2024-1316: Undefined Security Weakness

The Event Tickets and Registration WordPress plugin before 5.8.1, Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the contributor role from leaking the existence of certain events they shouldn't have access to. e.g. draft, private, pending review,...

WordPress Plugin Events Tickets Plus Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

CVE-2024-1122

The Event Manager, Events Calendar, Events Tickets for WooCommerce – Eventin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportdata function in all versions up to, and including, 3.3.50. This makes it possible for unauthenticated...