Event Tickets and Registration, CVE-2026-14819

CVE, Research URL: CVE-2026-14819
Home page URL: Security reports for Event Tickets and Registration
Application: Event Tickets and Registration
Published on: Jul 28, 2026
Research Description: The Event Tickets and Registration WordPress plugin before 5.28.4 does not properly escape event titles before outputting them in a ticket history log, allowing users with the Editor role and above to perform Stored Cross-Site Scripting attacks that execute against higher-privileged users on multisite installations.
Affected versions: max 5.28.4.
Status: vulnerable