The Event Tickets WordPress plugin before 5.2.2 does not validate the tribe_tickets_redirect_to parameter before redirecting the user to the given value, leading to an arbitrary redirect issue
CVSS 3.1MEDIUM 6.1·Network·No auth·User interaction·EPSS 0.01932·Published 2022-01-24·Fixed in 5.2.2CWE-601