CVE-2026-121858mediumCWE-89

CVE-2026-121858: medium-severity vulnerability in Event Tickets with Ticket Scanner

Event Tickets with Ticket Scanner < 3.2.9 - Authenticated SQLi via DataTables Search

Published

Follow this CVE+ Monitor Event Tickets with Ticket Scanner

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 6.3epss 0.2%
The Event Tickets with Ticket Scanner WordPress plugin before 3.2.9 does not properly escape a search value before using it in SQL queries in several of its admin listings, allowing users with access to its admin area (administrators by default, or any role granted access in its settings) to perform SQL injection attacks.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Affected products
Unknown · Event Tickets with Ticket Scanner
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Event Tickets with Ticket Scanner

In the same product, most dangerous first.

CVE-2024-6711LOWEvent Tickets with Ticket Scanner < 2.3.8 - Admin+ Stored XSSEPSS 0.3%CVE-2025-1762MEDIUMEvent Tickets with Ticket Scanner < 2.5.4 - Arbitrary Tickets Deletion via CSRFEPSS 0.2%CVE-2026-121857MEDIUMEvent Tickets with Ticket Scanner < 3.1.14 - Authenticated Ticket Data Disclosure and Removal via executeWCBackendEPSS 0.1%