Stored Cross-Site Scripting in Passeum Ticketing Plugin for WordPress

CVE-2026-7421

What is CVE-2026-7421?

The Passeum Ticketing plugin for WordPress is affected by a vulnerability that allows authenticated attackers with Administrator-level access to inject malicious scripts via the shop_name setting. This issue arises from the get_shop_url() method outputting unvalidated data when the shop_name starts with 'http'. As a result, attackers can set the shop_name to a URL they control, leading to the execution of arbitrary JavaScript and CSS on any frontend page that includes Passeum Ticketing shortcodes, consequently endangering all visitors to the site. This vulnerability does not impact single-site installations as they grant administrators the unfiltered_html capability.

References