Plugin icon

Tickera – Sell Tickets & Manage Events

tickera-event-ticketing-system

Vulnerabilities:

19

Last Updated:

September 16, 2026

Active Installs:

2000

Published
Title
Fixed in
CVSS
Published
2026-08-28
Title
Tickera – Sell Tickets & Manage Events < 3.6.0.3 - Unauthenticated PHP Object Injection
Fixed in
Fixed in 3.6.0.3
CVSS
8.1 (high)
Published
2026-07-22
Title
Tickera < 3.6.0.2 - Authenticated (Staff+) SQL Injection via 'tc_order_status_filter' Parameter
Fixed in
Fixed in 3.6.0.2
CVSS
6.5 (medium)
Published
2026-07-22
Title
Tickera < 3.6.0.2 - Authenticated (Staff+) SQL Injection via 'tc_event_filter' Parameter
Fixed in
Fixed in 3.6.0.2
CVSS
6.5 (medium)
Published
2026-07-15
Title
Tickera < 3.6.0.1 - Authenticated (Staff+) SQL Injection via 's' Parameter
Fixed in
Fixed in 3.6.0.1
CVSS
6.5 (medium)
Published
2026-07-15
Title
Tickera < 3.6.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'price_wrapper' Shortcode Attribute
Fixed in
Fixed in 3.6.0.1
CVSS
5.5 (medium)
Published
2026-02-17
Title
Tickera – WordPress Event Ticketing < 3.5.6.5 - Missing Authorization to Authenticated (Subscriber+) Event/Post Status Update
Fixed in
Fixed in 3.5.6.5
CVSS
4.3 (medium)
Published
2026-01-16
Title
Tickera < 3.5.6.3 - Missing Authorization
Fixed in
Fixed in 3.5.6.3
CVSS
4.3 (medium)
Published
2026-01-09
Title
Tickera < 3.5.6.5 - Missing Authorization
Fixed in
Fixed in 3.5.6.5
CVSS
4.3 (medium)
Published
2025-09-03
Title
Tickera < 3.5.5.8 - Cross-Site Request Forgery
Fixed in
Fixed in 3.5.5.8
CVSS
4.3 (medium)
Published
2025-03-27
Title
Tickera < 3.5.5.3 - Missing Authorization
Fixed in
Fixed in 3.5.5.3
CVSS
4.3 (medium)
Published
2024-12-13
Title
Tickera – WordPress Event Ticketing < 3.5.4.9 - Unauthenticated Customer Data Exposure
Fixed in
Fixed in 3.5.4.9
CVSS
5.3 (medium)
Published
2024-11-04
Title
Tickera – WordPress Event Ticketing < 3.5.4.6 - Unauthenticated Arbitrary Shortcode Execution
Fixed in
Fixed in 3.5.4.6
CVSS
7.3 (high)
Published
2024-06-17
Title
Tickera < 3.5.2.9 - Missing Authorization to Authenticated (Susbcriber+) Ticket Deletion
Fixed in
Fixed in 3.5.2.9
CVSS
4.3 (medium)
Published
2024-06-06
Title
Tickera < 3.5.2.7 - Missing Authorization
Fixed in
Fixed in 3.5.2.7
CVSS
4.3 (medium)
Published
2024-04-01
Title
Tickera < 3.5.2.5 - Ticket leakage through IDOR
Fixed in
Fixed in 3.5.2.5
CVSS
5.3 (medium)
Published
2022-12-23
Title
Tickera < 3.5.1.0 - Plugin Data Deletion via CSRF
Fixed in
Fixed in 3.5.1.0
CVSS
3.8 (low)
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Fixed in
Fixed in 3.4.9.2
CVSS
4.3 (medium)
Published
2021-11-23
Title
Tickera < 3.4.8.3 - Unauthenticated Stored Cross-Site Scripting
Fixed in
Fixed in 3.4.8.3
CVSS
8.8 (high)
Published
2020-04-11
Title
Tickera WordPress Event Ticketing < 3.4.6.9 - Unauthenticated Sensitive Data Exposure
Fixed in
Fixed in 3.4.6.9
CVSS
7.5 (high)