Code Injection Vulnerability in Event Tickets with Ticket Scanner by WordPress
CVE-2025-68015

9CRITICAL

Key Information:

Vendor

WordPress
Status
Event Tickets With Ticket Scanner
Vendor
CVE Published:
22 January 2026

What is CVE-2025-68015?

The Event Tickets with Ticket Scanner plugin for WordPress has a security flaw that allows for improper control of code generation. This vulnerability permits code injection, potentially enabling unauthorized execution of malicious code within the application environment. Affected versions are those prior to and including 2.8.3, highlighting the importance of updating to secure your site from exploitation.

Affected Version(s)

Event Tickets with Ticket Scanner 0 <= 2.8.5

References

https://patchstack.com/database/Wordpress/Plugin/event-ti...
vdb-entry

CVSS V3.1

Score:
9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

daroo | Patchstack Bug Bounty Program
.