PLUGIN SECURITY
Is Event Tickets safe?
Event Tickets allows your visitors to RSVP and buy tickets to events on your site. Also works seamlessly with The Events Calendar.
What this plugin does
- Slug:
event-tickets - Author: Nexcess
- 90000+ active installs
- 70/100 rating (236 reviews on wordpress.org)
- 8375433 all-time downloads
- On WordPress.org since 2015-12-02
attendee managementevent registrationRSVPticket salestickets
Maintenance status
- Last updated: 2026-11-04 5:49pm GMT
- Tested up to WordPress: 7.1.4
- Requires PHP: 7.4+
Known vulnerabilities
30 known CVEs on file for Event Tickets.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-62047 | Event Tickets and Registration [event-tickets] < 5.30.3 | — | Medium 4.3 | < 5.30.3 | 5.30.3 | 2026-10-30 | — |
| CVE-2026-62055 | Event Tickets and Registration [event-tickets] < 5.30.3 | — | Medium 4.3 | < 5.30.3 | 5.30.3 | 2026-10-30 | — |
| CVE-2026-105893 | Event Tickets and Registration [event-tickets] < 5.30.0.2 | — | Medium 5.3 | < 5.30.0.2 | 5.30.0.2 | 2026-10-08 | — |
| CVE-2026-105891 | Event Tickets and Registration [event-tickets] < 5.30.0.2 | — | Medium 4.3 | < 5.30.0.2 | 5.30.0.2 | 2026-10-08 | — |
| CVE-2026-105888 | Event Tickets and Registration [event-tickets] < 5.30.0.2 | — | Medium 5.4 | < 5.30.0.2 | 5.30.0.2 | 2026-10-08 | — |
| CVE-2026-110902 | Event Tickets and Registration [event-tickets] < 5.30.2 | — | Medium 4.3 | < 5.30.2 | 5.30.2 | 2026-10-08 | — |
| CVE-2026-104675 | Event Tickets and Registration [event-tickets] < 5.30.0.1 | — | Medium 4.3 | < 5.30.0.1 | 5.30.0.1 | 2026-10-05 | — |
| CVE-2026-97634 | Event Tickets and Registration [event-tickets] < 5.29.5.1 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Medium 6.5 | < 5.29.5.1 | 5.29.5.1 | 2026-09-30 | — |
+ 29 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-97287 | Event Tickets and Registration [event-tickets] < 5.29.5.1 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | High 8.5 | < 5.29.5.1 | 5.29.5.1 | 2026-09-23 | — |
| CVE-2026-93526 | Event Tickets and Registration [event-tickets] < 5.29.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 5.29.5 | 5.29.5 | 2026-09-07 | — |
| CVE-2026-78263 | Event Tickets and Registration [event-tickets] < 5.29.3 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 5.29.3 | 5.29.3 | 2026-08-24 | — |
| CVE-2026-14822 | Event Tickets and Registration [event-tickets] < 5.29.0.1 | Improper Access Control | Unknown | < 5.29.0.1 | 5.29.0.1 | 2026-08-01 | — |
| CVE-2026-14823 | Event Tickets and Registration [event-tickets] < 5.29.0.1 | Authorization Bypass Through User-Controlled Key | Unknown | < 5.29.0.1 | 5.29.0.1 | 2026-08-01 | — |
| CVE-2026-3174 | Event Tickets and Registration [event-tickets] < 5.27.4.1 | Missing Authorization | High 7.5 | < 5.27.4.1 | 5.27.4.1 | 2026-08-01 | — |
| CVE-2026-57705 | Event Tickets and Registration [event-tickets] < 5.28.5.1 | — | High 7.5 | < 5.28.5.1 | 5.28.5.1 | 2026-07-08 | — |
| CVE-2026-14819 | Event Tickets and Registration [event-tickets] < 5.28.4 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Unknown | < 5.28.4 | 5.28.4 | 2026-07-07 | — |
| CVE-2026-42662 | Event Tickets and Registration [event-tickets] < 5.27.6.1 | Authentication Bypass by Spoofing | Medium 6.5 | < 5.27.6.1 | 5.27.6.1 | 2026-05-02 | — |
| CVE-2025-11517 | Event Tickets and Registration [event-tickets] < 5.26.6 | Authorization Bypass Through User-Controlled Key | High 7.5 | < 5.26.6 | 5.26.6 | 2025-10-17 | — |
| CVE-2025-62027 | Event Tickets and Registration [event-tickets] < 5.26.4 | Missing Authorization | Medium 5.4 | < 5.26.4 | 5.26.4 | 2025-10-16 | — |
| CVE-2025-30794 | Event Tickets and Registration [event-tickets] < 5.20.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 5.20.1 | 5.20.1 | 2025-03-27 | — |
| CVE-2024-13457 | Event Tickets and Registration [event-tickets] < 5.18.1.1 | Improper Access Control | Medium 5.3 | < 5.18.1.1 | 5.18.1.1 | 2025-01-29 | — |
| CVE-2024-38762 | Event Tickets and Registration [event-tickets] < 5.11.0.5 | Cross-Site Request Forgery (CSRF) | Medium 4.3 | < 5.11.0.5 | 5.11.0.5 | 2024-07-12 | — |
| CVE-2024-2261 | Event Tickets and Registration [event-tickets] < 5.8.3 | Authorization Bypass Through User-Controlled Key | Medium 4.3 | < 5.8.3 | 5.8.3 | 2024-03-26 | — |
| CVE-2024-1053 | Event Tickets and Registration [event-tickets] < 5.8.2 | Improper Access Control | Medium 4.3 | < 5.8.2 | 5.8.2 | 2024-02-21 | — |
| CVE-2024-1316 | Event Tickets and Registration [event-tickets] < 5.8.1 | Improper Access Control | Medium 6.5 | < 5.8.1 | 5.8.1 | 2024-02-08 | — |
| CVE-2023-33999 | Event Tickets and Registration [event-tickets] < 5.6.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 5.6.0 | 5.6.0 | 2023-07-18 | — |
| — | Event Tickets and Registration [event-tickets] < 5.3.0.1 | Missing Authorization | Medium 6.3 | < 5.3.0.1 | 5.3.0.1 | 2022-03-04 | — |
| — | Event Tickets and Registration [event-tickets] < 5.3.0.1 | — | Unknown | < 5.3.0.1 | 5.3.0.1 | 2022-02-28 | — |
| — | Event Tickets and Registration [event-tickets] < 5.3.0.1 | — | Unknown | < 5.3.0.1 | 5.3.0.1 | 2022-02-28 | — |
| CVE-2021-25028 | Event Tickets and Registration [event-tickets] < 5.3.0.1 | URL Redirection to Untrusted Site ('Open Redirect') | Medium 6.1 | < 5.3.0.1 | 5.3.0.1 | 2021-12-22 | — |
| — | Event Tickets and Registration [event-tickets] < 4.10.7.2 | — | Unknown | < 4.10.7.2 | 4.10.7.2 | 2019-09-03 | — |
| CVE-2019-16120 | Event Tickets and Registration [event-tickets] < 4.10.7.2 | Improper Neutralization of Formula Elements in a CSV File | High 8.8 | < 4.10.7.2 | 4.10.7.2 | 2019-09-02 | — |
| — | Event Tickets and Registration [event-tickets] < 5.19.1.2 | Missing Authorization | Medium 5.3 | < 5.19.1.2 | 5.19.1.2 | 0000-00-00 | — |
| — | Event Tickets and Registration [event-tickets] < 5.29.1 | — | Unknown | < 5.29.1 | 5.29.1 | 0000-00-00 | — |
| — | Unauthorised AJAX Calls via Freemius | — | Unknown | < 5.3.0.1 | 5.3.0.1 | — | — |
| CVE-2025-1402 | Event Tickets and Registration < 5.19.1.2 - Missing Authorization to Ticket Deletion | — | Unknown | < 5.19.1.2 | 5.19.1.2 | — | — |
| CVE-2026-65567 | Event Tickets and Registration < 5.29.1 - Missing Authorization | — | Unknown | < 5.29.1 | 5.29.1 | — | — |
How to fix it
Update this plugin to the latest release from wordpress.org — each CVE above lists the exact release that fixed it ("Fixed in") when one is on file.
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce — 10000+ active installs — 94/100 (415) — max PHP 8.4
- Registrations for the Events Calendar – Event Registration Plugin — 7000+ active installs — 100/100 (103) — max PHP 8.4
- RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login — 7000+ active installs — 90/100 (459) — max PHP <8.0
- Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar — 6000+ active installs — 90/100 (167)
- Ticket Tailor — Event Ticketing & Registration — 4000+ active installs — 86/100 (46)
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.