4.8 Medium

CVE-2022-3609 The GetYourGuide Ticketing WordPress plugin before 1.0.4 does not sanitise and escape some parameters, which could allow…

Description

The GetYourGuide Ticketing WordPress plugin before 1.0.4 does not sanitise and escape some parameters, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Affected products and versions

Product	Affected versions	Fixed in
GetYourGuide Ticketing 1.0	earliest → < 1.0.4	1.0.4

Do you use GetYourGuide Ticketing?

Track this CVE Watch GetYourGuide Ticketing Check my SBOMs

www.cveye.io/en/cve/CVE-2022-3609

Timeline

Published December 12, 2022
Last modified April 22, 2025

References

wpscan.com wpscan.com

Track this CVE