The Tickera – Sell Tickets & Manage Events plugin for WordPress, specifically versions up to and including 3.6.0.0, is vulnerable to Stored Cross-Site Scripting via the 'price_wrapper' Shortcode Attribute. This vulnerability is due to insufficient input sanitization and output escaping. As a result, authenticated attackers with contributor-level access and above can inject arbitrary web scripts in pages. [truncated]
The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 3.6.0.0. This vulnerability is caused by insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. As a result, authenticated attackers with custom-level access and above can append additi [truncated]
