Is CVE-2026-14819 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-14819 being exploited in the wild.

How severe is CVE-2026-14819?

Informational severity, with a CVSS score of 3.5, published 28 July 2026.

Is there a fix for CVE-2026-14819?

A patch was published on 2026-07-07: Fixed version 5.28.4 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-14819 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-14819?

Check whether you run The Events Calendar Event Tickets and Registration at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-14819: The Events Calendar Event Tickets stored XSS in ticket history log

CVE-2026-14819 · Severity: info · CVSS 3.5 · Published 2026-07-28

A vulnerability exists in the Event Tickets and Registration WordPress plugin, which is used to manage event bookings and attendee lists. An authorized user with Editor-level access can insert malicious code into event titles that triggers when a site administrator views the ticket history logs. This could allow a lower-privileged user to hijack an administrator's session or perform unauthorized actions on the website, particularly in multisite environments.

Technologies: The Events Calendar Event Tickets and Registration. Vendors: The Events Calendar.

Quick answers

Is CVE-2026-14819 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-14819 being exploited in the wild.
How severe is CVE-2026-14819?: Informational severity, with a CVSS score of 3.5, published 28 July 2026.
Which products and versions are affected?: The Events Calendar Event Tickets and Registration < 5.28.4.
Is there a fix for CVE-2026-14819?: A patch was published on 2026-07-07: Fixed version 5.28.4 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-14819 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-14819?: Check whether you run The Events Calendar Event Tickets and Registration at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in the Event Tickets and Registration plugin for WordPress due to insufficient output escaping of event titles within the ticket history log component. An attacker with Editor-level privileges can set a malicious payload as an event title; when a ticket is moved to or from that event, the payload is recorded in the ticket's history. The script executes when a higher-privileged user, such as an Administrator or Super Admin, views the 'History' accordion in the ticket editor. This is particularly impactful in WordPress multisite installations where Editors typically lack the 'unfiltered_html' capability. The issue is fixed in version 5.28.4.

Affected products

The Events Calendar Event Tickets and Registration < 5.28.4

Timeline

2026-07-07: disclosed: Publicly published by WPScan
2026-07-28: advisory: NVD publication date
2026-07-07: patched: Fixed version 5.28.4 released

References

https://wpscan.com/vulnerability/678a362f-b71d-4308-8fc3-f3bf3e6c3ca9/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.