WordPress event-tickets has 7 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2019-16120 | CSV injection in the event-tickets (Event Tickets) plugin before 4.10.7.2 for WordPress exists via the "All Post> Ticketed > Attendees" Expo | high | 8.8 | <4.10.7.2 | 4.10.7.2 |
| CVE-2021-25028 | The Event Tickets WordPress plugin before 5.2.2 does not validate the tribe_tickets_redirect_to parameter before redirecting the user to the | medium | 6.1 | <5.2.2 | 5.2.2 |
| CVE-2024-1316 | The Event Tickets and Registration WordPress plugin before 5.8.1, Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users w | medium | 6.5 | <5.8.1 or <5.9.1 | 5.9.1 |
| CVE-2024-1319 | The Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the contributor role from leaking the attendees l | medium | 4.3 | <5.9.1 | 5.9.1 |
| CVE-2025-1402 | The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the | medium | 5.3 | <5.19.1.2 | 5.19.1.2 |
| CVE-2024-1053 | The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on th | medium | 4.3 | <5.8.2 | 5.8.2 |
| CVE-2024-13457 | The Event Tickets and Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and includi | medium | 5.3 | <5.18.1.1 | 5.18.1.1 |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked