Low severity3.5NVD Advisory· Published Jul 28, 2026· Updated Jul 28, 2026

CVE-2026-14819

Description

The Event Tickets and Registration WordPress plugin before 5.28.4 does not properly escape event titles before outputting them in a ticket history log, allowing users with the Editor role and above to perform Stored Cross-Site Scripting attacks that execute against higher-privileged users on multisite installations.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Event Tickets And Registrationllm-fuzzy2 versions
<5.28.4+ 1 more
- (no CPE)range: <5.28.4
- (no CPE)range: <5.28.4
Package: https://wordpress.org/plugins/event-tickets-and-registration

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/678a362f-b71d-4308-8fc3-f3bf3e6c3ca9/nvd

News mentions

No linked articles in our index yet.

cvss	0.227
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000