← back to popular plugins
wordfence / plugin · event-tickets
Event Tickets and Registration
event-tickets
total installs
90,000
total vulns
5
critical
0
high
1
medium
4
low
0
latest vuln
—
patched
5
unpatched
0
avg time to patch
—
vulnerabilities
(5)
Event Tickets and Registration <= 5.27.5 - Missing Authorization
medium
✓ patched
The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 5.27.5. This makes it possible for unauthenticated attackers to perform an unauthorized action.
Event Tickets and Registration <= 5.26.5 - Unauthenticated Ticket Payment Bypass
high
✓ patched
cve id
CVE-2025-11517 ↗
cvss score
7.5
cwe
CWE-639: Authorization Bypass Through User-Controlled Key
published
Oct 17, 2025
The Event Tickets and Registration plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 5.26.5. This is due to the /wp-json/tribe/tickets/v1/commerce/free/order endpoint not verifying that a ticket type should be free allowing the user to bypass the payment. This makes it possible for unauthenticated attackers to obtain access to paid tickets, without paying for them, causing a loss of revenue for the target.
Event Tickets <= 5.26.3 - Missing Authorization
medium
✓ patched
The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 5.26.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.
Event Tickets <= 5.20.0 - Reflected Cross-Site Scripting
medium
✓ patched
cve id
CVE-2025-30794 ↗
cvss score
6.1
cwe
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
published
Mar 27, 2025
The Event Tickets plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 5.20.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Event Tickets and Registration <= 5.19.1.1 - Missing Authorization to Ticket Deletion
medium
✓ patched
The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'ajax_ticket_delete' function in all versions up to, and including, 5.19.1.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary Attendee tickets.