CVE-2026-97287
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Blind SQL Injection. This issue affects Event Tickets: from n/a through 5.29.5.
Risk Assessment
An attacker can perform blind SQL queries, potentially leading to disclosure of database data, including user data and passwords.
Recommendation
It is recommended to update the Event Tickets plugin to the latest version and use prepared statements.
Other vulnerabilities in Event Tickets
See all- CVE-2026-105893Medium
Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Manipulating User-Controlled Variables. This issue affects Event Tickets: from n/a through 5.30.0.1.
- CVE-2026-65567Medium
The Event Tickets plugin version 5.29.0.1 and earlier has a broken access control vulnerability without authentication. An unauthenticated attacker can access functions intended for authorized users.
- CVE-2026-105891Medium
Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Event Tickets: from n/a through 5.30.0.1.
- CVE-2026-105888Medium
Missing authorization in Event Tickets (up to 5.30.0.1) allows exploiting incorrectly configured access control security levels.
- CVE-2026-104675Medium
Missing authorization in Event Tickets plugin up to version 5.30.0. Allows exploitation of incorrectly configured access control security levels.
- CVE-2026-93526High
Unauthenticated Cross Site Scripting (XSS) in Event Tickets versions up to 5.29.4.
- CVE-2026-78263High
Unauthenticated Cross Site Scripting (XSS) vulnerability in Event Tickets versions up to and including 5.29.2.1.
- CVE-2026-57705High
The Event Tickets plugin for WordPress contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 5.28.5.
- CVE-2026-42662Medium
Event Tickets versions up to 5.27.5 contain a vulnerability that allows unauthenticated bypass of security measures.
- CVE-2025-62027Medium
The Event Tickets plugin by StellarWP in versions up to and including 5.26.3 contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This may enable unauthorized operations on tickets or events.
Original NVD description (English source)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Blind SQL Injection.This issue affects Event Tickets: from n/a through 5.29.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS