CVE-2026-14819 Overview
CVE-2026-14819 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting the Event Tickets and Registration WordPress plugin in versions before 5.28.4. The plugin fails to properly escape event titles before rendering them in the ticket history log. Authenticated users with the Editor role or higher can inject JavaScript payloads through event titles. The stored payload executes in the browser of any higher-privileged user who views the ticket history log on multisite installations.
Critical Impact
Editors on multisite WordPress deployments can execute arbitrary JavaScript in the browser sessions of administrators, enabling session theft or unauthorized actions performed with elevated privileges.
Affected Products
- Event Tickets and Registration WordPress plugin versions prior to 5.28.4
- WordPress multisite installations running the vulnerable plugin
- Deployments where Editor-role accounts are provisioned to untrusted users
Discovery Timeline
- 2026-07-28 - CVE-2026-14819 published to NVD
- 2026-07-28 - Last updated in NVD database
Technical Details for CVE-2026-14819
Vulnerability Analysis
The vulnerability resides in the ticket history log rendering path of the Event Tickets and Registration plugin. When the plugin displays event titles within the ticket history log, it emits the stored title value directly into the HTML output without applying output escaping. An attacker with Editor privileges can create or edit an event and set its title to a payload containing HTML or JavaScript. The malicious title is persisted in the database and rendered later when a higher-privileged user, typically an administrator, views the ticket history log.
Exploitation requires user interaction because the target must load the ticket history log view. The scope is unchanged, and confidentiality and integrity impacts are limited to actions the victim's session is authorized to perform. On multisite installations, the higher-privileged super-admin context increases the value of the executed payload.
Root Cause
The root cause is missing output encoding [CWE-79] on event title fields prior to inclusion in the rendered ticket history log. WordPress provides context-appropriate escaping helpers such as esc_html() and esc_attr(), but the affected code path emits stored title content without invoking them.
Attack Vector
The attack vector is network-based and authenticated. An Editor-role user submits an event whose title contains an XSS payload. When an administrator or higher-privileged user later opens the ticket history log, the browser parses and executes the payload in the administrator's authenticated context. Refer to the WPScan Vulnerability Report for additional technical details.
Detection Methods for CVE-2026-14819
Indicators of Compromise
- Event titles containing HTML tags, <script> fragments, or JavaScript event handler attributes such as onerror= and onmouseover=.
- Unexpected outbound HTTP requests from administrator browser sessions shortly after viewing the ticket history log.
- New administrator or super-admin accounts created without a corresponding legitimate workflow entry.
Detection Strategies
- Query the WordPress wp_posts table for event post types with titles containing angle brackets, script tags, or JavaScript URI schemes.
- Review web server access logs for Editor-role users submitting event creation or update requests with suspicious payloads in title parameters.
- Inspect browser Content Security Policy (CSP) violation reports for inline script execution originating from plugin-rendered pages.
Monitoring Recommendations
- Alert on privilege changes, new administrator account creation, and modifications to wp-config.php following ticket history log access.
- Track plugin version inventory across all WordPress sites and flag any instance running Event Tickets and Registration below 5.28.4.
- Monitor session cookie usage patterns for administrator accounts to identify concurrent sessions or unusual source IPs.
How to Mitigate CVE-2026-14819
Immediate Actions Required
- Upgrade the Event Tickets and Registration plugin to version 5.28.4 or later on all WordPress sites and network subsites.
- Audit existing event titles across all sites for stored payloads and sanitize or remove suspicious entries before administrators view them.
- Review Editor-role assignments on multisite installations and revoke accounts that do not require content authoring privileges.
Patch Information
The vendor addressed CVE-2026-14819 in Event Tickets and Registration version 5.28.4 by applying proper output escaping to event titles rendered in the ticket history log. Site operators should apply the update through the WordPress plugin management interface or via WP-CLI. See the WPScan Vulnerability Report for advisory details.
Workarounds
- If patching is not immediately feasible, restrict access to the ticket history log administrative view to trusted accounts.
- Deploy a Web Application Firewall (WAF) rule to block requests containing HTML or script fragments in event title parameters.
- Enforce a strict Content Security Policy that disallows inline script execution on WordPress admin pages.
# Update the plugin via WP-CLI on a WordPress multisite installation
wp plugin update event-tickets --version=5.28.4 --network
wp plugin list --name=event-tickets --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
