High severity · published Nov 5, 2024
CVE-2024-10263
Tickera – WordPress Event Ticketing <= 3.5.4.4 - Unauthenticated Arbitrary Shortcode Execution
7.3
CVSS
0.5%
EPSS
No
On KEV
Description
The Tickera – WordPress Event Ticketing plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.5.4.4. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TS
Tickera – Sell Tickets & Manage Events · tickera
through 3.5.4.4 · source: vendor
TI
Tickera · Tickera
before 3.5.4.6 · source: NVD, CISA
Affected product
TS
Tickera – Sell Tickets & Manage Events
tickera
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-10263
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-10263
Patch
https://plugins.trac.wordpress.org/changeset/3179272/tickera-event-ticketing-system
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/6e5e9249-9705-4cfa-9c8e-2e002190562b?source=cve
More from Tickera – Sell Tickets & Manage Events
6.5
CVE-2026-15448
Tickera <= 3.6.0.1 - Authenticated (Staff+) SQL Injection via 'tc_order_status_filter' Parameter
6.5
CVE-2026-15761
Tickera <= 3.6.0.1 - Authenticated (Staff+) SQL Injection via 'tc_event_filter' Parameter
6.5
CVE-2026-13754
Tickera <= 3.6.0.0 - Authenticated (Staff+) SQL Injection via 's' Parameter
6.4
CVE-2026-13755
Tickera <= 3.6.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'price_wrapper' Shortcode Attribute
5.3
CVE-2024-12578
Tickera – WordPress Event Ticketing <= 3.5.4.8 - Unauthenticated Customer Data Exposure