CVE-2026-13755 describes a stored cross-site scripting vulnerability in the Tickera – Sell Tickets & Manage Events WordPress plugin. The issue exists in all versions up to and including 3.6.0.0 due to improper neutralization of input in the 'price_wrapper' shortcode attribute. Authenticated attackers with contributor-level privileges or higher can inject arbitrary scripts that execute when a user visits a page containing the injected content, but only if the victim has the corresponding ticket ID in their cart cookie. The vulnerability has a CVSS 3.1 base score of 6.4, indicating medium severity, with network attack vector, low attack complexity, and no user interaction required. Confidentiality and integrity impacts are low, with no availability impact.

Successful exploitation allows an authenticated attacker to inject and execute arbitrary JavaScript in the context of affected users who have the specific ticket ID in their cart cookie. This can lead to limited confidentiality and integrity impacts such as session hijacking or unauthorized actions within the application context. The attack is constrained by the requirement that the victim must have the referenced ticket in their cart cookie for the payload to execute.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access and above to trusted users only. Monitor vendor channels for updates regarding patches or official mitigations addressing this vulnerability.