Description
The Event Tickets with Ticket Scanner WordPress plugin before 3.2.9 does not properly escape a search value before using it in SQL queries in several of its admin listings, allowing users with access to its admin area (administrators by default, or any role granted access in its settings) to perform SQL injection attacks.
Published:
2026-11-07
Score:
n/a
EPSS:
n/a
KEV:
No
Impact:
n/a
Action:
n/a
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Unknown | Event Tickets with Ticket Scanner | unaffected |
|
No data.
No data.
No data available yet.
Remediation
No remediation available yet.
Tracking
Sign in to view the affected projects.
Advisories
No advisories yet.
References
History
Sat, 07 Nov 2026 06:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The Event Tickets with Ticket Scanner WordPress plugin before 3.2.9 does not properly escape a search value before using it in SQL queries in several of its admin listings, allowing users with access to its admin area (administrators by default, or any role granted access in its settings) to perform SQL injection attacks. | |
| Title | Event Tickets with Ticket Scanner < 3.2.9 - Authenticated SQLi via DataTables Search | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: WPScan
Published:
Updated: 2026-11-07T06:00:29.004Z
Reserved: 2026-11-04T09:23:13.992Z
Link: CVE-2026-121858
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-07T06:16:58.847
Modified: 2026-11-07T06:16:58.847
Link: CVE-2026-121858
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses
No weakness.