Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2025-11517

Event Tickets and Registration <= 5.26.5 - Unauthenticated Ticket Payment Bypass

The Event Tickets and Registration plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 5.26.5. This is due to the /wp-json/tribe/tickets/v1/commerce/free/order endpoint not verifying that a ticket type should be free allowing the user to bypass the payment. This makes it possible for unauthenticated attackers to obtain access to paid tickets, without paying for them, causing a loss of revenue for the target.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Theeventscalendar Wordpress
Products
Event Tickets Wordpress
CVE-2025-1402

Event Tickets and Registration <= 5.19.1.1 - Missing Authorization to Ticket Deletion

The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'ajax_ticket_delete' function in all versions up to, and including, 5.19.1.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary Attendee tickets.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Theeventscalendar
Products
Event Tickets