Event Tickets < 5.28.4 – Editor+ Stored XSS via Ticket Move | CVE 2026-14819

Description

The plugin does not properly escape event titles before outputting them in a ticket history log, allowing users with the Editor role and above to perform Stored Cross-Site Scripting attacks that execute against higher-privileged users on multisite installations.

Proof of Concept

Prerequisite: a multisite install (an Editor lacks unfiltered_html there); the Move Tickets feature (default).

1. As an Editor, set a malicious title on an event (or any ticketed post you can edit): <img src=x onerror=alert(document.domain)>
2. In Tickets, move any ticket to or from that event (Move Tickets). The move logs the event title into the moved ticket's history.
3. As an Administrator or Super Admin, open the moved ticket in the ticket editor and expand the "History" accordion.
4. The stored title renders unescaped and the onerror payload executes in the admin's session.