CVE-2019-16120

The CVE-2019-16120 issue affects the WordPress Event Tickets plugin (Event Tickets) prior to version 4.10.7.2. The vulnerability arises in the Export Attendees feature under All Post > Ticketed > Attendees, allowing CSV injection. Impact is potential data manipulation/CSV injection in expor...

CVE-2024-1053

CVE-2024-1053 affects the WordPress plugin “Event Tickets and Registration.” A missing capability check on the email action in versions up to and including 5.8.1 allows authenticated users with contributor-level access and above to email the attendees list to themselves. Impact is listed as data ...

CVE-2024-1316

The Event Tickets and Registration WordPress plugin (versions before 5.8.1 ) and the Events Tickets Plus WordPress plugin (versions before 5.9.1 ) are vulnerable to Broken Access Control . The flaw allows users with at least the contributor role to leak the existence of events they are not author...

CVE-2024-1319

The Events Tickets Plus WordPress plugin, in versions prior to 5.9.1 , is susceptible to a Broken Access Control vulnerability. Users with at least the contributor role can leak the attendees list on any post type, including those with statuses such as draft , private , pending review , password-...

CVE-2024-13457

CVE-2024-13457 affects the WordPress plugin Event Tickets and Registration (WordPress Event Tickets) up to and including version 5.18.1 . The vulnerability is an Insecure Direct Object Reference via the tc-order-id parameter, arising from missing validation on a user-controlled key. This allows u...