Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-12
Event Tickets and Registration - Security Vulnerability (CVE-2026-122061)
The Event Tickets and Registration WordPress plugin before 5.30.3.1 does not correctly check whether an event displays a public attendee list before returning one of its attendees over the REST API, allowing unauthenticated users to retrieve the names of attendees of events that do not show a public attendee list.
PLUGIN
Event Tickets and Registration
CVE-2026-122061
Risk Score
Threat Entry
Updated 2026-11-12
Event Tickets and Registration - Security Vulnerability (CVE-2026-122087)
The Event Tickets and Registration WordPress plugin before 5.30.3.1 does not restrict attendee data to events the requester is allowed to view, allowing unauthenticated users to retrieve the attendees of private and other non-public events.
PLUGIN
Event Tickets and Registration
CVE-2026-122087
Risk Score
Threat Entry
Updated 2026-10-02
Event Tickets and Registration - Security Vulnerability (CVE-2026-97634)
The Event Tickets and Registration plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 5.29.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. A Contributor-level user can reach the vulnerable code path by supplying a post_id…
PLUGIN
Event Tickets and Registration
CVE-2026-97634
Risk Score
Threat Entry
Updated 2026-09-09
Event Tickets and Registration - Broken Access Control (CVE-2026-3174)
The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Stripe OAuth return endpoint in all versions up to, and including, 5.27.4. This makes it possible for unauthenticated attackers to overwrite the site's Stripe merchant credentials (access tokens, publishable keys, and account ID), diverting all subsequent payment processing to the attacker's Stripe account.
PLUGIN
Event Tickets and Registration
CVE-2026-3174
Risk Score
Threat Entry
Updated 2026-08-26
Event Tickets and Registration - Security Vulnerability (CVE-2026-14822)
The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not perform any authorization check on one of its order-management REST endpoints, allowing unauthenticated users to change the status of existing orders.
PLUGIN
Event Tickets and Registration
CVE-2026-14822
Risk Score
Threat Entry
Updated 2026-08-26
Event Tickets and Registration - Security Vulnerability (CVE-2026-14823)
The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not properly verify authorization on some of its seating actions, allowing users with contributor-level access and above to overwrite the seating layout, ticket inventory, and attendee seat assignments of events they do not own.
PLUGIN
Event Tickets and Registration
CVE-2026-14823
Risk Score
Threat Entry
Updated 2026-07-28
Event Tickets and Registration - Cross-Site Scripting (XSS) (CVE-2026-14819)
The Event Tickets and Registration WordPress plugin before 5.28.4 does not properly escape event titles before outputting them in a ticket history log, allowing users with the Editor role and above to perform Stored Cross-Site Scripting attacks that execute against higher-privileged users on multisite installations.
PLUGIN
Event Tickets and Registration
CVE-2026-14819
Risk Score
Threat Entry
Updated 2026-06-17
Event Tickets and Registration - Security Vulnerability (CVE-2025-11517)
The Event Tickets and Registration plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 5.26.5. This is due to the /wp-json/tribe/tickets/v1/commerce/free/order endpoint not verifying that a ticket type should be free allowing the user to bypass the payment. This makes it possible for unauthenticated attackers to obtain access to paid tickets, without paying for them, causing a loss of revenue for the target.
PLUGIN
Event Tickets and Registration
CVE-2025-11517
Risk Score
Threat Entry
Updated 2026-06-17
Event Tickets and Registration - Broken Access Control (CVE-2025-1402)
The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'ajax_ticket_delete' function in all versions up to, and including, 5.19.1.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary Attendee tickets.
PLUGIN
Event Tickets and Registration
CVE-2025-1402
Risk Score
Threat Entry
Updated 2026-06-17
Event Tickets and Registration - Security Vulnerability (CVE-2024-13457)
The Event Tickets and Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.18.1 via the tc-order-id parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view order details of orders they did not place, which includes ticket prices, user emails and order date.
PLUGIN
Event Tickets and Registration
CVE-2024-13457
Risk Score
Threat Entry
Updated 2026-06-17
Event Tickets and Registration - Cross-Site Request Forgery (CSRF) (CVE-2022-4974)
The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable.
PLUGIN
Event Tickets and Registration
CVE-2022-4974
Risk Score
Threat Entry
Updated 2026-06-17
Event Tickets and Registration - Information Disclosure (CVE-2024-2261)
The Event Tickets and Registration plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.8.2 via the RSVP functionality. This makes it possible for authenticated attackers, with contributor access and above, to extract sensitive data including emails and street addresses.
PLUGIN
Event Tickets and Registration
CVE-2024-2261
Risk Score
Threat Entry
Updated 2026-06-17
Event Tickets and Registration - Security Vulnerability (CVE-2024-1316)
The Event Tickets and Registration WordPress plugin before 5.8.1, Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the contributor role from leaking the existence of certain events they shouldn't have access to. (e.g. draft, private, pending review, pw-protected, and trashed events).
PLUGIN
Event Tickets and Registration
CVE-2024-1316
Risk Score
Threat Entry
Updated 2026-06-17
Event Tickets and Registration - Broken Access Control (CVE-2024-1053)
The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'email' action in all versions up to, and including, 5.8.1. This makes it possible for authenticated attackers, with contributor-level access and above, to email the attendees list to themselves.
PLUGIN
Event Tickets and Registration
CVE-2024-1053
Risk Score