The Event Tickets and Registration WordPress plugin versions prior to 5.28.4 do not properly escape event titles when displaying them in the ticket history log. This improper output encoding enables users with Editor privileges or above to perform stored Cross-Site Scripting (CWE-79) attacks. The injected scripts execute in the browsers of higher-privileged users on multisite setups, potentially leading to limited confidentiality and integrity impacts. The CVSS 3.1 base score is 3.5, reflecting low severity with network attack vector, low complexity, high privileges required, and user interaction needed.

Successful exploitation allows an attacker with Editor or higher privileges to inject malicious scripts into event titles that are stored and later executed in the browsers of higher-privileged users on multisite WordPress installations. This can lead to limited confidentiality and integrity impacts such as session hijacking or unauthorized actions performed in the context of the victim user. Availability impact is not present. No known active exploitation has been reported.

No official fix or patch has been confirmed or published yet. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict Editor and higher roles to trusted users only and consider monitoring or limiting input fields that accept event titles. Avoid clicking suspicious links or interacting with untrusted content in the ticket history log.