PT-2025-46255 · WordPress · Eventbee Ticketing Widget

Published 2025-11-11 · Updated 2025-11-11 · CVE-2025-11856

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Eventbee Ticketing Widget versions prior to 1.0

Description The Eventbee Ticketing Widget plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'eventbeeticketwidget' shortcode. This occurs because the plugin does not adequately sanitize user input and output of several parameters. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages. These scripts will execute when a user accesses the affected page.

Recommendations Update the Eventbee Ticketing Widget plugin to a version later than 1.0.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-11856

Affected Products

Eventbee Ticketing Widget

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-11856 · Security Note
• https://plugins.trac.wordpress.org/browser/eventbee-ticketing-widget/tags/1.0/ticket-widget.php#L23 · Note
• https://twitter.com/CVEnew/status/1988095320916365687 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/7c439193-cc7d-4e40-8585-87cb2c40fe9b?source=cve · Note