Executive Summary

The Passeum Ticketing plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in all versions up to and including 1.0. This occurs because the plugin's get_shop_url() method returns the shop_name setting without sanitizing it when it starts with "http". Additionally, the validate_shop_name() function only checks if the value is empty or a string, which is insufficient validation.

An authenticated attacker with Administrator-level access or higher can exploit this by setting the shop_name to a URL controlled by the attacker (e.g., https://attacker.com). This causes the plugin to enqueue external JavaScript and CSS from the attacker's domain via wp_register_script() and wp_register_style(). The injected scripts then execute on every frontend page containing any Passeum Ticketing shortcode, affecting all site visitors.

Note that this vulnerability does not affect single-site installations because administrators there already have the unfiltered_html capability.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker with administrator-level access to inject arbitrary external scripts into the website. These scripts execute on every frontend page containing Passeum Ticketing shortcodes, potentially affecting all visitors to the site.

• Execution of malicious JavaScript on visitors' browsers, which can lead to theft of sensitive information such as cookies or credentials.
• Defacement or manipulation of website content.
• Potential distribution of malware or redirecting users to malicious sites.
• Loss of user trust and damage to the website's reputation.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows authenticated administrators to inject arbitrary external scripts that execute on frontend pages for all site visitors. This could lead to unauthorized data exposure or manipulation through cross-site scripting attacks.

Such unauthorized script execution can potentially compromise user data confidentiality and integrity, which may impact compliance with data protection regulations like GDPR and HIPAA that require safeguarding personal and sensitive information.

However, the CVE description does not explicitly mention compliance impacts or regulatory considerations.

Useful 0 Not Useful 0