Tickera <= 3.6.0.0 Authenticated Stored XSS via price_wrapper (CVE-2026-13755) Advisory

Vulnerability Overview Vulnerability Name: Tickera <= 3.6.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'price_wrapper' Shortcode Attribute CVE ID: CVE-2026-13755 CVSS Score: 6.4 (Medium) Publication Date: July 15, 2026 Last Updated: July 16, 2026 Researchers: PRISM - Wordfence Impact Scope Affected Versions: Tickera <= 3.6.0.0 Vulnerability Type: Stored Cross-Site Scripting (XSS) Attack Conditions: Requires authenticated user privileges (Contributor+ level) Description: The Tickera - Sell Tickets & Manage Events plugin, in version 3.6.0.0 and earlier, contains a stored cross-site scripting vulnerability. Due to insufficient input validation and output escaping, attackers can inject malicious scripts which are executed when users visit pages containing the injected script. Remediation Fixed Version: 3.6.0.1 Recommendation: Upgrade to version 3.6.0.1 or later to fix this vulnerability. Additional Information References: - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org Recent Vulnerability List Tickera <= 3.6.0.0 - Authenticated (Staff+) SQL Injection via 's' Parameter - CVE ID: CVE-2026-13754 - CVSS Score: 6.5 - Researchers: PRISM - Publication Date: July 15, 2026 Tickera - WordPress Event Ticketing <= 3.5.4.8 - Missing Authorization to Authenticated (Subscriber+) Event/Post Status Update - CVE ID: CVE-2025-12356 - CVSS Score: 4.3 - Researchers: Athiwat Tprasanam (Jitada) - Publication Date: February 17, 2026 Tickera <= 3.5.6.2 - Missing Authorization - CVE ID: CVE-2025-67939 - CVSS Score: 4.3 - Researchers: daroo - Publication Date: January 16, 2026 Tickera <= 3.5.6.4 - Missing Authorization - CVE ID: CVE-2025-69355 - CVSS Score: 4.3 - Researchers: Nabil Irawan - Publication Date: January 9, 2026 Tickera <= 3.5.5.6 - Cross-Site Request Forgery - CVE ID: CVE-2025-58611 - CVSS Score: 4.3 - Researchers: Nguyen Xuan Chien - Publication Date: September 3, 2025 Tickera <= 3.5.5.2 - Missing Authorization - CVE ID: CVE-2025-30851 - CVSS Score: 4.3 - Researchers: Peter Thaleikis - Publication Date: March 27, 2025 Tickera - WordPress Event Ticketing <= 3.5.4.8 - Unauthenticated Customer Data Exposure - CVE ID: CVE-2024-12578 - CVSS Score: 5.3 - Researchers: Aaron Schilt, Paule - Publication Date: December 13, 2024 Tickera - WordPress Event Ticketing <= 3.5.4.4 - Unauthenticated Arbitrary Shortcode Execution - CVE ID: CVE-2024-10263 - CVSS Score: 7.3 - Researchers: Arkadiusz Hydzik - Publication Date: November 4, 2024 Tickera <= 3.5.2.8 - Missing Authorization to Authenticated (Subscriber+) Ticket Deletion - CVE ID: CVE-2024-5860 - CVSS Score: 4.3 - Researchers: Lucio Sá - Publication Date: June 17, 2024 Tickera <= 3.5.2.6 - Missing Authorization - CVE ID: CVE-2024-35729 - CVSS Score: 4.3 - Researchers: Manab Jyoti Dwarah - Publication Date: June 6, 2024 Summary This page primarily introduces multiple security vulnerabilities present in the Tickera plugin, particularly focusing on stored cross-site scripting (Stored XSS). Users are advised to upgrade to version 3.6.0.1 or later as soon as possible to remediate these vulnerabilities.

Goal Reached Thanks to every supporter — we hit 100%!

Tickera <= 3.6.0.0 Authenticated Stored XSS via price_wrapper (CVE-2026-13755) Advisory

More from this source