The Passeum Ticketing WordPress plugin (<=1.0) suffers from a stored cross-site scripting vulnerability (CWE-79) caused by the get_shop_url() method returning the shop_name setting without proper sanitization if it starts with "http". The validate_shop_name() function inadequately validates this setting, only checking for non-empty strings. Authenticated users with Administrator-level privileges can exploit this by setting shop_name to an attacker-controlled URL, which leads the plugin to enqueue external JavaScript and CSS from the attacker domain via wp_register_script() and wp_register_style(). This results in arbitrary script execution on all frontend pages with Passeum Ticketing shortcodes, impacting all visitors. Single-site installations are not affected due to administrators having the unfiltered_html capability. No official patch or remediation guidance is currently available.

An attacker with Administrator-level access can inject and execute arbitrary external scripts on all frontend pages containing Passeum Ticketing shortcodes, potentially compromising site visitors. The vulnerability does not affect single-site installations where administrators have unfiltered_html capability. The CVSS 3.1 score is 4.4 (medium severity), reflecting network attack vector, high attack complexity, high privileges required, no user interaction, and partial confidentiality and integrity impact without availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Administrator-level access to trusted users only and consider disabling or removing the Passeum Ticketing plugin if possible. Monitor for updates from the vendor regarding a security patch.