The Passeum Ticketing plugin allows an authenticated user with administrator privileges to store a malicious script by setting the shop_name option to a value beginning with "http". Because the plugin outputs the shop_name without sanitization, the script is executed on every front‑end page that uses any Passeum Ticketing shortcode. The injected script runs in the browsers of all site visitors, enabling actions such as cookie theft, session hijacking, or phishing attacks. This vulnerability is a classic stored cross‑site scripting flaw, classified as CWE‑79.

All installations of the Passeum Ticketing WordPress plugin up to and including version 1.0 on multisite networks are affected. The issue does not occur on single‑site installations where administrators already possess the unfiltered_html capability. The vulnerable code resides in the get_shop_url() method and validate_shop_name() function of the plugin’s core files.

The CVSS score of 4.4 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it is not currently widely exploited. However, any site that has an administrator with the ability to modify the shop_name setting is at risk, and the stored nature of the flaw means that visitors can be impacted without further interaction. An attacker must first authenticate as an administrator on a multisite network; once that prerequisite is satisfied, the attacker can inject arbitrary external scripts that are served from the attacker‑controlled domain.