PT-2026-45887 · WordPress · Passeum Ticketing
CVSS v3.1
4.4
Medium
| Vector | AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Passeum Ticketing versions prior to 1.1
Description
The plugin is subject to Stored Cross-Site Scripting. This occurs because the
get shop url() method returns the shop name setting value without sanitization when it starts with "http", and the validate shop name() function only verifies if the value is a non-empty string. Authenticated attackers with Administrator-level access or higher can inject arbitrary external scripts by setting shop name to a URL they control. This leads the plugin to enqueue external JavaScript and CSS from the attacker-controlled domain using wp register script() and wp register style(). The scripts execute on every frontend page containing a Passeum Ticketing shortcode, impacting all visitors. This issue does not affect single-site installations as administrators in those environments already possess the unfiltered html capability.Recommendations
Update the plugin to a version later than 1.0.
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Passeum Ticketing