CVE-2026-105891
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Event Tickets: from n/a through 5.30.0.1.
Risk Assessment
An attacker may perform unauthorized operations within the plugin, potentially leading to modification of event data or configuration.
Recommendation
Update the Event Tickets plugin to a version later than 5.30.0.1. Review user role permissions.
Other vulnerabilities in Event Tickets
See all- CVE-2026-110902Medium
Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.1.
- CVE-2026-105893Medium
Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Manipulating User-Controlled Variables. This issue affects Event Tickets: from n/a through 5.30.0.1.
- CVE-2026-62047Medium
The Event Tickets plugin (Liquid Web / StellarWP) through 5.30.2 contains a missing authorization vulnerability. This allows exploitation of incorrectly configured access control security levels.
- CVE-2026-62055Medium
Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.2.
- CVE-2026-105888Medium
Missing authorization in Event Tickets (up to 5.30.0.1) allows exploiting incorrectly configured access control security levels.
- CVE-2026-104675Medium
Missing authorization in Event Tickets plugin up to version 5.30.0. Allows exploitation of incorrectly configured access control security levels.
- CVE-2026-97287High
The Event Tickets plugin (Liquid Web / StellarWP) is vulnerable to SQL Injection (Blind SQL Injection) due to improper neutralization of special elements in SQL commands. This issue affects Event Tickets from n/a through 5.29.5.
- CVE-2026-93526High
Unauthenticated Cross Site Scripting (XSS) in Event Tickets versions up to 5.29.4.
- CVE-2026-78263High
Unauthenticated Cross Site Scripting (XSS) vulnerability in Event Tickets versions up to and including 5.29.2.1.
- CVE-2026-65567Medium
The Event Tickets plugin version 5.29.0.1 and earlier has a broken access control vulnerability without authentication. An unauthenticated attacker can access functions intended for authorized users.
Original NVD description (English source)
Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.0.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS