CVE-2026-14819

LOW

Event Tickets < 5.28.4 - Editor+ Stored XSS via Ticket Move

Title source: cna

Description

The Event Tickets and Registration WordPress plugin before 5.28.4 does not properly escape event titles before outputting them in a ticket history log, allowing users with the Editor role and above to perform Stored Cross-Site Scripting attacks that execute against higher-privileged users on multisite installations.

References (1)

Core 1

Core References

Exploit exploit vdb-entry technical-description

https://wpscan.com/vulnerability/678a362f-b71d-4308-8fc3-f3bf3e6c3ca9/

Scores

CVSS v3 3.5

EPSS 0.0014

EPSS Percentile 4.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-79

Status published

Products (1)

None/Event Tickets and Registration < 5.28.4

Published Jul 28, 2026

Tracked Since Jul 28, 2026