CVE-2026-7421

An authenticated attacker with Administrator-level access can set the `shop_name` option to an attacker-controlled URL, such as `https://attacker.com` [ref_id=1]. This causes the plugin to enqueue external JavaScript and CSS from the attacker's domain via `wp_register_script()` and `wp_register_style()` [ref_id=1]. The injected scripts will then execute on any frontend page that includes a Passeum Ticketing shortcode, affecting all site visitors [ref_id=1].

The vulnerability lies within the `register_assets()` method of the Passeum Ticketing plugin. Specifically, the `get_shop_url()` method is called with the `shop_name` setting, and its return value is used directly in `wp_register_style()` and `wp_register_script()` [ref_id=1, ref_id=2, ref_id=3, ref_id=4]. The `validate_shop_name()` function, which is responsible for validating this setting, does not perform adequate sanitization.

The patch is not provided in the bundle. The advisory indicates that the vulnerability is due to insufficient validation in the `validate_shop_name()` function and the `get_shop_url()` method not sanitizing the `shop_name` setting. Remediation guidance would typically involve sanitizing the `shop_name` input to prevent the inclusion of external scripts.