CVE-2026-7421
Stored XSS in Passeum Ticketing WordPress Plugin
Publication date: 2026-06-03
Last updated on: 2026-06-03
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| passeum | passeum_ticketing | to 1.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Passeum Ticketing plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in all versions up to and including 1.0. This occurs because the plugin's get_shop_url() method returns the shop_name setting without sanitizing it when it starts with "http". Additionally, the validate_shop_name() function only checks if the value is empty or a string, which is insufficient validation.
An authenticated attacker with Administrator-level access or higher can exploit this by setting the shop_name to a URL controlled by the attacker (e.g., https://attacker.com). This causes the plugin to enqueue external JavaScript and CSS from the attacker's domain via wp_register_script() and wp_register_style(). The injected scripts then execute on every frontend page containing any Passeum Ticketing shortcode, affecting all site visitors.
Note that this vulnerability does not affect single-site installations because administrators there already have the unfiltered_html capability.
How can this vulnerability impact me? :
This vulnerability allows an attacker with administrator-level access to inject arbitrary external scripts into the website. These scripts execute on every frontend page containing Passeum Ticketing shortcodes, potentially affecting all visitors to the site.
- Execution of malicious JavaScript on visitors' browsers, which can lead to theft of sensitive information such as cookies or credentials.
- Defacement or manipulation of website content.
- Potential distribution of malware or redirecting users to malicious sites.
- Loss of user trust and damage to the website's reputation.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows authenticated administrators to inject arbitrary external scripts that execute on frontend pages for all site visitors. This could lead to unauthorized data exposure or manipulation through cross-site scripting attacks.
Such unauthorized script execution can potentially compromise user data confidentiality and integrity, which may impact compliance with data protection regulations like GDPR and HIPAA that require safeguarding personal and sensitive information.
However, the CVE description does not explicitly mention compliance impacts or regulatory considerations.