The Event Tickets with Ticket Scanner WordPress plugin before 3.2.9 does not properly escape a search value before using it in SQL queries in several of its admin listings, allowing users with access to its admin area (administrators by default, or any role granted access in its settings) to perform SQL injection attacks.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Unknown | Event Tickets with Ticket Scanner | unaffected |
|
No data.
No data.
No data.
Project Subscriptions
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Sat, 07 Nov 2026 06:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The Event Tickets with Ticket Scanner WordPress plugin before 3.2.9 does not properly escape a search value before using it in SQL queries in several of its admin listings, allowing users with access to its admin area (administrators by default, or any role granted access in its settings) to perform SQL injection attacks. | |
| Title | Event Tickets with Ticket Scanner < 3.2.9 - Authenticated SQLi via DataTables Search | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: WPScan
Published:
Updated: 2026-11-07T06:00:29.004Z
Reserved: 2026-11-04T09:23:13.992Z
Link: CVE-2026-121858
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-07T06:16:58.847
Modified: 2026-11-07T06:16:58.847
Link: CVE-2026-121858
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses
No weakness.