CVE-2026-78263: WordPress Event Tickets plugin <= 5.29.2.1 - Cross Site Scripting (XSS) vulnerability
Published Aug 24, 2026
·Updated
Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.2.1 versions.
Affected Software
1 affected component
WordPress Event Tickets plugin<=5.29.2.1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Event Tickets Pluginto a version that resolves this vulnerability.Fixed in 5.29.3
Event History
Aug 24, 2026
CVE Published
via MITRE·09:31 PM
Data Sourced
via MITRE·09:31 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·10:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What must an attacker do to exploit this issue?
The vulnerability is unauthenticated and network-reachable, so an attacker does not need an account. Exploitation requires user interaction, meaning a victim must interact with attacker-controlled content.
2
Which installations are affected?
WordPress sites using the Event Tickets plugin version 5.29.2.1 or earlier are affected.
3
What is the potential impact?
Successful exploitation can allow cross-site scripting in a victim’s browser, with low impact to confidentiality, integrity, and availability. The scope may extend beyond the vulnerable component.