CVE-2026-7421: Passeum Ticketing Plugin XSS Vulnerability

CVE-2026-7421 Overview

CVE-2026-7421 is a Stored Cross-Site Scripting (XSS) vulnerability in the Passeum Ticketing plugin for WordPress, affecting all versions up to and including 1.0. The flaw resides in the plugin's shop URL handling logic, where the get_shop_url() method returns the shop_name setting without sanitization when the value begins with http. Authenticated attackers holding Administrator-level access on multisite installations can inject arbitrary external scripts that execute on every frontend page rendering a Passeum Ticketing shortcode. Single-site installations are not affected because administrators already hold the unfiltered_html capability. The issue is tracked under CWE-79.

Critical Impact

Authenticated administrators on WordPress multisite installations can load attacker-controlled JavaScript and CSS on every public page that contains a Passeum Ticketing shortcode, exposing all visitors to client-side compromise.

Affected Products

• Passeum Ticketing plugin for WordPress, all versions through 1.0
• WordPress multisite installations using the plugin
• Frontend visitors of any site rendering a Passeum Ticketing shortcode

Discovery Timeline

• 2026-06-03 - CVE-2026-7421 published to NVD
• 2026-06-04 - Last updated in NVD database

Technical Details for CVE-2026-7421

Vulnerability Analysis

The Passeum Ticketing plugin exposes a shop_name setting that is intended to hold a textual store name. The validate_shop_name() function in inc/settings.php only verifies that the submitted value is a non-empty string. It performs no URL validation, no scheme allow-listing, and no HTML escaping. The plugin then passes that value to get_shop_url() in passeum-ticketing.php. When the stored value begins with http, get_shop_url() returns it verbatim as a URL.

That URL is consumed by wp_register_script() and wp_register_style(), which the plugin invokes whenever a Passeum Ticketing shortcode is rendered. As a result, the plugin enqueues remote JavaScript and CSS from an attacker-controlled origin on every frontend page that uses the shortcode. The injected script executes in the context of the victim site and can perform actions such as session theft, credential harvesting, defacement, or drive-by redirection.

Root Cause

The root cause is a combination of weak input validation in validate_shop_name() and missing output encoding in get_shop_url(). A free-form text setting is treated as a trusted URL and reused as the source for browser-loaded assets. The plugin conflates two distinct concerns, a display name and a remote asset host, into a single unvalidated field.

Attack Vector

Exploitation requires an authenticated user with Administrator privileges on a multisite WordPress deployment. The attacker navigates to the Passeum Ticketing settings page and sets shop_name to a value beginning with http, such as https://attacker.com. Once any frontend page containing a Passeum Ticketing shortcode is loaded, the plugin enqueues scripts and styles from that origin. Every site visitor executes the attacker's payload.

No direct code example is provided. Refer to the Wordfence Vulnerability Analysis and the WordPress Plugin Settings Code for the vulnerable source lines.

Detection Methods for CVE-2026-7421

Indicators of Compromise

• Unexpected <script> or <link> tags on frontend pages that reference external domains not controlled by the site owner.
• A shop_name value in the Passeum Ticketing options that starts with http:// or https://.
• Outbound DNS or HTTP requests from visitors' browsers to unfamiliar third-party hosts when Passeum Ticketing shortcodes are rendered.

Detection Strategies

• Audit the wp_options table for the Passeum Ticketing shop_name entry and flag values that parse as URLs.
• Compare current page source against a known-good baseline to identify newly enqueued scripts or stylesheets.
• Review WordPress activity logs for changes to plugin settings by Administrator accounts on multisite networks.

Monitoring Recommendations

• Enable a web application firewall ruleset that inspects WordPress admin POST requests for URL-shaped values in plugin settings fields.
• Monitor Content Security Policy (CSP) violation reports for unexpected script-src or style-src origins.
• Alert on administrative configuration changes to ticketing or commerce plugins on multisite installations.

How to Mitigate CVE-2026-7421

Immediate Actions Required

• Inspect the Passeum Ticketing shop_name setting on every site in the network and reset any value that contains a URL.
• Deactivate the Passeum Ticketing plugin on multisite deployments until a patched release is available.
• Review Administrator accounts on multisite networks and revoke or rotate credentials for any unauthorized or unused users.

Patch Information

At the time of publication, no fixed version is referenced in the NVD entry. Monitor the Wordfence Vulnerability Analysis and the Passeum Ticketing plugin repository for an updated release that sanitizes the shop_name value and validates URL inputs before enqueuing them.

Workarounds

• Restrict access to the Network Admin interface so only trusted operators can modify plugin settings on multisite installations.
• Apply a strict Content Security Policy that allow-lists only known asset origins for script-src and style-src.
• Remove Passeum Ticketing shortcodes from public pages until the plugin is patched, which prevents the vulnerable enqueue path from executing.

# Example: query the shop_name option across a WordPress multisite using WP-CLI
wp site list --field=url | while read site; do
  wp option get passeum_ticketing_shop_name --url="$site" 2>/dev/null
done