stellarwp Vulnerabilities and Affected Products
Vulnerabilities associated with Event Tickets.
Products
Clear product- GiveWP – Donation Plugin and Fundraising Platform31 vulnerabilities
- Kadence Blocks — Page Builder Toolkit for Gutenberg Editor29 vulnerabilities
- The Events Calendar19 vulnerabilities
- GiveWP10 vulnerabilities
- Membership Plugin – Restrict Content7 vulnerabilities
- Event Tickets and Registration6 vulnerabilities
- LearnDash LMS5 vulnerabilities
- Bookit — Booking & Appointment Calendar3 vulnerabilities
- Event Tickets3 vulnerabilities
- Gutenberg Blocks by Kadence Blocks3 vulnerabilities
- Kadence WooCommerce Email Designer3 vulnerabilities
- WPComplete3 vulnerabilities
- Restrict Content2 vulnerabilities
- Give – Divi Donation Modules1 vulnerability
- Image Widget1 vulnerability
- iThemes Sync1 vulnerability
- LearnDash LMS – Reports1 vulnerability
- Membership Plugin – Kadence Memberships1 vulnerability
- the_events_calendar1 vulnerability
- Virtue1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2025-62027MEDIUM | WordPress Event Tickets plugin <= 5.26.3 - Broken Access Control vulnerabilityMissing Authorization vulnerability in StellarWP Event Tickets event-tickets.This issue affects Event Tickets: from n/a through <= 5.26.3. CWE-862Oct 22, 2025 | CVSS5.4v3.1 | EPSS0.202% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-30794HIGH | WordPress Event Tickets plugin <= 5.20.0 - Reflected Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StellarWP Event Tickets event-tickets allows Reflected XSS.This issue affects Event Tickets: from n/a through <= 5.20.0. CWE-79Apr 1, 2025 | CVSS7.1v3.1 | EPSS0.293% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-38762MEDIUM | WordPress Event Tickets and Registration plugin <= 5.11.0.4 - Cross Site Request Forgery (CSRF) vulnerabilityCross-Site Request Forgery (CSRF) vulnerability in StellarWP Event Tickets event-tickets allows Cross Site Request Forgery.This issue affects Event Tickets: from n/a through <= 5.11.0.4. CWE-352Jan 2, 2025 | CVSS4.3v3.1 | EPSS0.195% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |