Executive brief
The Tickera plugin for WordPress, which is used to sell and manage event tickets, contains a security flaw that allows users with contributor-level access to inject malicious scripts into website pages. These scripts could potentially steal information or perform unauthorized actions on behalf of other users. However, the attack is limited in scope, as the malicious code only triggers for visitors who have already added a specific ticket to their digital shopping cart.
Technical details
The Tickera plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'price_wrapper' shortcode attribute. Authenticated attackers with contributor-level permissions or higher can inject arbitrary web scripts into pages. The vulnerability is located in the shortcode processing logic within 'includes/classes/class.shortcodes.php'. A successful exploit requires the victim to have the specific ticket ID referenced in the malicious shortcode present in their cart cookie, meaning the payload only executes for users who have previously added that ticket to their cart. A patch appears to be available in versions following 3.6.0.0.
Affected products
- Tickera Tickera – Sell Tickets & Manage Events up to, and including, 3.6.0.0
Timeline
- 2026-07-16: disclosed
- 2026-07-16: advisory
References
- https://plugins.trac.wordpress.org/browser/tickera-event-ticketing-system/tags/3.6.0.0/includes/classes/class.shortcodes.php
- https://plugins.trac.wordpress.org/browser/tickera-event-ticketing-system/tags/3.6.0.0/includes/classes/class.shortcodes.php
- https://plugins.trac.wordpress.org/browser/tickera-event-ticketing-system/tags/3.6.0.0/includes/classes/class.shortcodes.php
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3605637%40tickera-event-ticketing-system&new=3605637%40tickera-event-ticketing-system
- https://www.wordfence.com/threat-intel/vulnerabilities/id/f266f9db-a25e-4f50-b3c8-3bea3a7e86ce?source=cve