CVE-2026-105891

Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Manipulating User-Controlled Variables. This issue affects Event Tickets: from n/a through 5.30.0.1.

The Event Tickets plugin version 5.29.0.1 and earlier has a broken access control vulnerability without authentication. An unauthenticated attacker can access functions intended for authorized users.

Missing authorization in Event Tickets (up to 5.30.0.1) allows exploiting incorrectly configured access control security levels.

Missing authorization in Event Tickets plugin up to version 5.30.0. Allows exploitation of incorrectly configured access control security levels.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Blind SQL Injection. This issue affects Event Tickets: from n/a through 5.29.5.

Unauthenticated Cross Site Scripting (XSS) in Event Tickets versions up to 5.29.4.

Unauthenticated Cross Site Scripting (XSS) vulnerability in Event Tickets versions up to and including 5.29.2.1.

The Event Tickets plugin for WordPress contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 5.28.5.

Event Tickets versions up to 5.27.5 contain a vulnerability that allows unauthenticated bypass of security measures.

The Event Tickets plugin by StellarWP in versions up to and including 5.26.3 contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This may enable unauthorized operations on tickets or events.