Dashboard / CVE-2026-121858

CVE-2026-121858

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 53/100
Published: 2026-11-07 Modified: 2026-11-07 First seen: 2026-11-07 Status: active

Attack Surface

Network No Interaction Conf. Impact Scope Change

CVSS Vector Breakdown

AV: Network
AC: High
PR: Low
UI: None
S: Changed
C: High
I: None
A: None

Description

The Event Tickets with Ticket Scanner WordPress plugin before 3.2.9 does not properly escape a search value before using it in SQL queries in several of its admin listings, allowing users with access to its admin area (administrators by default, or any role granted access in its settings) to perform SQL injection attacks.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
Unknown Event Tickets with Ticket Scanner 0 < 3.2.9
Unknown Event Tickets with Ticket Scanner 0 < 3.2.9

References & Advisories (1)

Bug Bounty Relevance

53 / 100
✓ Network accessible
✓ No user interaction

CVSS Score

6.3 / 10.0 v3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

EPSS — Exploitation Probability

0.18%
Raw Score 0.001830
Percentile 7.9%
Date 2026-11-08

EPSS Trend

2026-11-08
0.00183
2026-11-07
0.00157

Intelligence Sources

mitre ref →
nvd ref →

External Links