CVE-2026-14819 — Event Tickets < 5.28.4 - Editor+ Stored XSS via Ticket Move
The Event Tickets and Registration WordPress plugin before 5.28.4 does not properly escape event titles before outputting them in a ticket history log, allowing users with the E…
Published: 2026-07-28 · CVSS: 3.5 · CVSS 3.1
The Event Tickets and Registration WordPress plugin before 5.28.4 does not properly escape event titles before outputting them in a ticket history log, allowing users with the Editor role and above to perform Stored Cross-Site Scripting attacks that execute against higher-privileged users on multisite installations.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7