CyberRota Analysis
AI-GeneratedThe Event Tickets and Registration plugin for WordPress prior to version 5.28.4 is vulnerable due to improper escaping of event titles in ticket history logs, which can lead to Stored Cross-Site Scripting (XSS) attacks. This vulnerability allows users with Editor roles and above to execute malicious scripts against higher-privileged users in multisite environments. WordPress administrators and site owners using this plugin should prioritize updating to mitigate potential security risks.
Original NVD Description
The Event Tickets and Registration WordPress plugin before 5.28.4 does not properly escape event titles before outputting them in a ticket history log, allowing users with the Editor role and above to perform Stored Cross-Site Scripting attacks that execute against higher-privileged users on multisite installations.