CVE-2026-93526
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Unauthenticated Cross Site Scripting (XSS) in Event Tickets versions up to 5.29.4.
Risk Assessment
An attacker can inject malicious script into the page, potentially leading to session theft or admin account takeover.
Recommendation
Update the Event Tickets plugin to the latest version that includes the security fix.
Other vulnerabilities in Event Tickets
See all- CVE-2026-65567Medium
The Event Tickets plugin version 5.29.0.1 and earlier has a broken access control vulnerability without authentication. An unauthenticated attacker can access functions intended for authorized users.
- CVE-2026-78263High
Unauthenticated Cross Site Scripting (XSS) vulnerability in Event Tickets versions up to and including 5.29.2.1.
- CVE-2026-57705High
The Event Tickets plugin for WordPress contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 5.28.5.
- CVE-2026-42662Medium
Event Tickets versions up to 5.27.5 contain a vulnerability that allows unauthenticated bypass of security measures.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.4 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS