7.3
High
CVE-2024-10263 The Tickera – WordPress Event Ticketing plugin for WordPress is vulnerable to arbitrary shortcode execution in all…
Description
The Tickera – WordPress Event Ticketing plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.5.4.4. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Tickera – WordPress Event Ticketing 3.5 | earliest → 3.5.4.4 | No fix stated |
| Tickera 3.5 | earliest → 3.5.4.4 | No fix stated |
| Tickera – Sell Tickets & Manage Events 3.5 | earliest → 3.5.4.4 | No fix stated |
Other CVEs of Tickera – WordPress Event Ticketing
The 4 CVEs of Tickera – WordPress Event Ticketing →
CVE-2024-12578
The Tickera – WordPress Event Ticketing plugin for WordPress is vulnerable to Information Exposure in all versions up…
5.3
Medium
CVE-2022-4974
The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request…
6.3
Medium
CVE-2024-5860
The Tickera – WordPress Event Ticketing plugin for WordPress is vulnerable to unauthorized loss of data due to a missing…
4.3
Medium