Junglewise Threat Intelligence

CVE-2026-7421: Passeum Ticketing Stored XSS in shop_name setting

CVE-2026-7421 · Severity: medium · CVSS 4.4 · Published 2026-06-03

Executive brief

The Passeum Ticketing plugin for WordPress, which manages event ticketing and shop integration, contains a security flaw that allows high-level users to inject malicious scripts into the website. In multi-site environments, an administrator could use this to run unauthorized code that affects all visitors on pages where the ticketing features are used. This could lead to the theft of visitor information or unauthorized actions being performed in their browsers.

Technical details

The Passeum Ticketing plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input validation and output sanitization in the `validate_shop_name()` and `get_shop_url()` functions. Specifically, the plugin fails to sanitize the `shop_name` setting when it begins with 'http', allowing an authenticated attacker with Administrator-level privileges to provide a malicious URL. This URL is subsequently used to enqueue external JavaScript and CSS files via `wp_register_script()` and `wp_register_style()`. The vulnerability primarily impacts WordPress Multi-site installations where administrators may not have the `unfiltered_html` capability. When exploited, the malicious scripts execute in the context of any site visitor viewing a page containing a Passeum Ticketing shortcode.

Affected products

  • Passeum Passeum Ticketing up to, and including, 1.0

Timeline

  • 2026-06-03: disclosed: CVE published by Wordfence/NVD

References