Executive brief
A vulnerability exists in the Event Tickets and Registration WordPress plugin, which is used to manage event bookings and attendee lists. An authorized user with Editor-level access can insert malicious code into event titles that triggers when a site administrator views the ticket history logs. This could allow a lower-privileged user to hijack an administrator's session or perform unauthorized actions on the website, particularly in multisite environments.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the Event Tickets and Registration plugin for WordPress due to insufficient output escaping of event titles within the ticket history log component. An attacker with Editor-level privileges can set a malicious payload as an event title; when a ticket is moved to or from that event, the payload is recorded in the ticket's history. The script executes when a higher-privileged user, such as an Administrator or Super Admin, views the 'History' accordion in the ticket editor. This is particularly impactful in WordPress multisite installations where Editors typically lack the 'unfiltered_html' capability. The issue is fixed in version 5.28.4.
Affected products
- The Events Calendar Event Tickets and Registration < 5.28.4
Timeline
- 2026-07-07: disclosed: Publicly published by WPScan
- 2026-07-28: advisory: NVD publication date
- 2026-07-07: patched: Fixed version 5.28.4 released