CVE-2026-105889 is a SQL injection vulnerability in the Tickera tickera-event-ticketing-system plugin, affecting versions from n/a through 3.6.0.6. This issue allows for Blind SQL Injection and has a CVSS score of 9.3, indicating critical severity. The vulnerability can lead to potential unauthorized data access. Defenders should verify exposure, prioritize remediation, and monitor for potential Blind SQL [truncated]
The Tickera – Sell Tickets & Manage Events plugin for WordPress, specifically versions up to and including 3.6.0.0, is vulnerable to Stored Cross-Site Scripting via the 'price_wrapper' Shortcode Attribute. This vulnerability is due to insufficient input sanitization and output escaping. As a result, authenticated attackers with contributor-level access and above can inject arbitrary web scripts in pages. [truncated]
The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 3.6.0.0. This vulnerability is caused by insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. As a result, authenticated attackers with custom-level access and above can append additi [truncated]
