CVE-2026-7421 is a stored cross-site scripting vulnerability in the Passeum Ticketing plugin for WordPress. The vulnerability arises from insufficient input sanitization and validation of the shop_name setting used in the get_shop_url() method. When shop_name begins with "http", it is used to enqueue external JavaScript and CSS resources without sanitization, allowing an authenticated administrator to inject arbitrary scripts from an attacker-controlled domain. These scripts execute on all frontend pages containing Passeum Ticketing shortcodes, potentially impacting all site visitors. Single-site installations are not affected due to existing unfiltered_html capabilities for administrators. No patch or vendor advisory is currently available.

An attacker with Administrator-level access can inject and execute arbitrary external scripts on frontend pages that use Passeum Ticketing shortcodes. This can lead to client-side code execution affecting all visitors to those pages. The vulnerability does not impact single-site installations where administrators have unfiltered_html capability. The CVSS score of 4.4 reflects limited impact due to required high privileges and attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Administrator-level access to trusted users only. Review and monitor plugin settings for unauthorized changes to the shop_name value. Consider disabling or removing the Passeum Ticketing plugin if not essential.