Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-15023 | 6.5 medium | 1.0% | no CPE yet | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to generic SQL Injection via Stored 'meta_key' via Event/Location Duplicate Action in all versions up to, and including, 7.4.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a second-order SQL injection: an attacker first plants SQL metacharacters in a custom meta key via the standard add-meta flow (WordPress stores these verbatim in wp_postmeta), then triggers the injection by invoking the event_duplicate or location_duplicate action, which reads the stored meta keys via get_post_meta() and concatenates them unsafely into the INSERT query. | 12 Oct |
| CVE-2026-97287 | 8.5 high | 0.00% | no CPE yet | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Blind SQL Injection. This issue affects Event Tickets: from n/a through 5.29.5. | 15 Oct |
| CVE-2026-34898 | 7.5 high | 0.00% | no CPE yet | Unauthenticated Broken Access Control in Event Tickets Manager for WooCommerce <= 1.5.3 versions. | Sun 25 Oct |
| CVE-2026-57705 | 7.5 high | 0.00% | no CPE yet | Missing Authorization vulnerability in Nexcess Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through <= 5.28.5. | Sat 24 Oct |
| CVE-2025-11517 | 7.5 high | 0.00% | no CPE yet | The Event Tickets and Registration plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 5.26.5. This is due to the /wp-json/tribe/tickets/v1/commerce/free/order endpoint not verifying that a ticket type should be free allowing the user to bypass the payment. This makes it possible for unauthenticated attackers to obtain access to paid tickets, without paying for them, causing a loss of revenue for the target. | 9 Oct |
| CVE-2026-78263 | 7.1 high | 0.00% | no CPE yet | Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.2.1 versions. | 12 Oct |
| CVE-2026-42662 | 6.5 medium | 0.00% | no CPE yet | Unauthenticated Bypass Vulnerability in Event Tickets <= 5.27.5 versions. | Sun 25 Oct |
| CVE-2026-57400 | 6.5 medium | 0.00% | no CPE yet | Missing Authorization vulnerability in WP Swings Event Tickets Manager for WooCommerce event-tickets-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets Manager for WooCommerce: from n/a through <= 1.5.5. | Sat 24 Oct |
| CVE-2026-55190 | 6.5 medium | 0.00% | no CPE yet | Event Schedule is an open-source platform to share events, sell tickets and bring communities together. In versions 1.0.0 and prior, App\Utils\UrlUtils::isUrlSafe() is the SSRF guard applied to user-supplied import URLs. It can be bypassed two ways, both reaching internal/localhost services when the URL is later fetched by ImportCuratorEvents (Http::get($url) then the response body is parsed and imported as events, and file_get_contents($ogImage)). At time of publication, there are no publicly available patches. | 23 Oct |
| CVE-2025-9875 | 6.4 medium | 0.00% | no CPE yet | The Event Tickets, RSVPs, Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ticket_spot' shortcode in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 8 Oct |
| CVE-2025-14945 | 5.4 medium | 0.00% | no CPE yet | The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via event attribute values in all versions up to, and including, 7.3.3. This is due to insufficient input sanitization when storing attribute values (using only `wp_unslash()` without sanitization) and lack of output escaping when rendering the '#_ATT{key}' placeholder. This makes it possible for authenticated attackers, with Author-level access and above, or unauthenticated attackers when anonymous event submissions are enabled, to inject arbitrary web scripts that execute when any user views the affected event page. | 19 Oct |
| CVE-2026-105888 | 5.4 medium | 0.00% | no CPE yet | Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.0.1. | 8 Oct |
| CVE-2025-62027 | 5.4 medium | 0.00% | no CPE yet | Missing Authorization vulnerability in StellarWP Event Tickets event-tickets.This issue affects Event Tickets: from n/a through <= 5.26.3. | 8 Oct |
| CVE-2026-65567 | 5.3 medium | 0.00% | no CPE yet | Unauthenticated Broken Access Control in Event Tickets <= 5.29.0.1 versions. | Sat 24 Oct |
| CVE-2026-105893 | 5.3 medium | 0.00% | no CPE yet | Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Manipulating User-Controlled Variables.This issue affects Event Tickets: from n/a through 5.30.0.1. | 8 Oct |
| CVE-2026-62047 | 4.3 medium | — | liquid web / stellarwp, event tickets | Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.2. | 4 h ago |
| CVE-2026-62055 | 4.3 medium | — | liquid web / stellarwp, event tickets | Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.2. | 5 h ago |
| CVE-2026-110902 | 4.3 medium | 0.00% | no CPE yet | Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.1. | 19 Oct |
| CVE-2026-105891 | 4.3 medium | 0.00% | no CPE yet | Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.0.1. | 10 Oct |
19 of 19
Download these 19 as CSV · subscribe to this list.
EPSS scores: 2026-10-29. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.