Event Tickets Editors can store script in ticket history on multisite
Event Tickets and Registration before 5.28.4 fails to escape an Editor-controlled event title when rendering it in a ticket history log on WordPress multisite. An Editor can store script markup in the title, and that script executes in the site origin when a higher-privileged user views the affected history entry. The WPScan CNA record does not disclose the request endpoint, title parameter, storage function or history-rendering function.
- Component
- Event Tickets and Registration
- Plugin slug
event-tickets-and-registration- Affected
- < 5.28.4
- Safe version
5.28.4- Published
- Jul 28, 2026
This CVE was published Jul 28, 2026 and is one of 3 known issues for this plugin.
Update, patch or deactivate.
Update Event Tickets and Registration to 5.28.4 or later. On multisite installations, review Editor-controlled event titles and ticket history entries for unexpected markup before a privileged user opens them.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Event Tickets and Registration WordPress plugin before 5.28.4 does not properly escape event titles before outputting them in a ticket history log, allowing users with the Editor role and above to perform Stored Cross-Site Scripting attacks that execute against higher-privileged users on multisite installations.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N