Read the docs

tickera

Records22All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9

Exploited now

tickera records in CISA KEV

No tickera vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Tickera 6 records MEDIUM Restrict 1 record LOW

Records

6 records in Tickera · all components

TI-2023-06636 CVE-2023-7252 · GHSA-6cxj-fx46-x5rx

Tickera < 3.5.2.5 - Ticket leakage through IDOR

Priority MEDIUM 63

The Tickera WordPress plugin before 3.5.2.5 does not prevent users from leaking other users' tickets.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00515 Published 2024-04-22 Fixed in 3.5.2.5
TI-2022-04153 CVE-2022-4549 · GHSA-xj3h-ghff-wj93

Tickera < 3.5.1.0 - Plugin Data Deletion via CSRF

Priority MEDIUM 53

The Tickera WordPress plugin before 3.5.1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin change them via a CSRF attack.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00295 Published 2023-01-16 Fixed in 3.5.1.0
TI-2024-23598 CVE-2024-35729 · GHSA-4pg5-hx4c-34cx

WordPress Tickera plugin <= 3.5.2.6 - Broken Access Control vulnerability

Priority MEDIUM 44

Missing Authorization vulnerability in Tickera Tickera tickera-event-ticketing-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tickera: from n/a through <= 3.5.2.6.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00336 Published 2024-06-10 No fix listed CWE-862
TI-2021-07079 CVE-2021-24797 · GHSA-h5xm-qm7g-wc4p

Tickera < 3.4.8.3 - Unauthenticated Stored Cross-Site Scripting

Priority LOW 30

The Tickera WordPress plugin before 3.4.8.3 does not properly sanitise and escape the Name fields of booked Events before outputting them in the Orders admin dashboard, which could allow unauthenticated users to perform…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01186 Published 2021-12-27 Fixed in 3.4.8.3 CWE-79
TI-2024-05434 CVE-2024-5860 · GHSA-3qj5-4m44-45xw

Tickera <= 3.5.2.8 - Missing Authorization to Authenticated (Susbcriber+) Ticket Deletion

Priority LOW 20

The Tickera – WordPress Event Ticketing plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the tc_dl_delete_tickets AJAX action in all versions up to, and including, 3.5.…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0028 Published 2024-06-18 No fix listed CWE-862
Open these records in search →