rootpwn

high · CVSS v3 8.5

CVE-2026-97287

A SQL injection vulnerability exists in the Contributor module of Event Tickets plugin versions up to 5.29.5. Attackers can inject arbitrary

Overview

A SQL injection vulnerability exists in the Contributor module of Event Tickets plugin versions up to 5.29.5. Attackers can inject arbitrary SQL via unfiltered input, potentially compromising the database. This flaw can lead to data exposure or modification.

Description

Contributor SQL Injection in Event Tickets <= 5.29.5 versions.

Impact

Confidentiality: attackers can read sensitive data. Integrity: can modify or delete records. Availability: may cause database errors. Impacted: WordPress site owners using Event Tickets plugin, especially those with contributor roles.

Remediation

Update Event Tickets to 5.29.6 or later. If update is not possible, disable contributor functionality or restrict contributor role. Ensure database credentials have least privilege.

Risk context

High severity (CVSS 8.5). Immediate attention recommended.

Affected products

  • Event Tickets <=5.29.5
  • Modern Tribe Event Tickets
  • WordPress Event Tickets plugin

Scores

Severity
high
CVSS v2
7.5
CVSS v3
8.5
CVSS v4
—
EPSS
—

sql-injection wordpress event-tickets plugin high-severity database

← All CVEs

Related CVEs

high

CVE-2026-97347

The Post Views Stats Counter plugin for WordPress is vulnerable to stored XSS via the User-Agent header in all versions up to 1.1.7. Unauthenticated attackers can inject malicious scripts that execute when users view any page served by the plugin, enabling defacement, credential theft, or malware distribution.

View analysis

high

CVE-2026-97250

Unauthenticated XSS vulnerability in Geo Mashup plugin versions <=1.13.21 allows attackers to inject malicious scripts via user input, potentially leading to session hijacking, defacement, or phishing. The flaw resides in the plugin's handling of map parameters.

View analysis

high

CVE-2026-97253

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kreatura LayerSlider allows Reflected XSS. This issue affects LayerSlider: from n/a through 8.4.0.

View analysis

high

CVE-2026-97271

Unauthenticated cross‑site scripting (XSS) exists in WPFunnels plugin versions up to 3.13.1, allowing attackers to inject malicious scripts into pages viewed by any user. The flaw can be triggered without authentication, making it trivial for an attacker to target site visitors. It is a high‑severity vulnerability with a CVSS v3 score of 7.1.

View analysis