{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-0507", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-01-15T20:25:22.290Z", "datePublished": "2025-01-31T04:21:46.537Z", "dateUpdated": "2026-04-08T16:36:50.817Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:36:50.817Z"}, "affected": [{"vendor": "snexed", "product": "Ticketmeo \u2013 Sell Tickets \u2013 Event Ticketing", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.3.6", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Ticketmeo \u2013 Sell Tickets \u2013 Event Ticketing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 2.3.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Ticketmeo \u2013 Sell Tickets \u2013 Event Ticketing <= 2.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/149edbdf-4a27-4d79-8dd1-b5b3efbf648b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ploxel/tags/2.2.0/ploxel.php#L49"}, {"url": "https://plugins.trac.wordpress.org/changeset/3231203/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "SOPROBRO"}], "timeline": [{"time": "2024-12-15T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-01-30T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-01-31T15:36:52.690622Z", "id": "CVE-2025-0507", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-10T22:07:59.206Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-0507", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-31T15:36:52.690622Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-31T15:36:54.208Z"}}], "cna": {"title": "Ticketmeo \u2013 Sell Tickets \u2013 Event Ticketing <= 2.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode", "credits": [{"lang": "en", "type": "finder", "value": "SOPROBRO"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "snexed", "product": "Ticketmeo \u2013 Sell Tickets \u2013 Event Ticketing", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "2.3.6"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2024-12-15T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-01-30T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/149edbdf-4a27-4d79-8dd1-b5b3efbf648b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ploxel/tags/2.2.0/ploxel.php#L49"}, {"url": "https://plugins.trac.wordpress.org/changeset/3231203/"}], "descriptions": [{"lang": "en", "value": "The Ticketmeo \u2013 Sell Tickets \u2013 Event Ticketing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 2.3.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-01-31T04:21:46.537Z"}}}, "cveMetadata": {"cveId": "CVE-2025-0507", "state": "PUBLISHED", "dateUpdated": "2025-02-10T22:07:59.206Z", "dateReserved": "2025-01-15T20:25:22.290Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-01-31T04:21:46.537Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Ticketmeo \u2013 Sell Tickets \u2013 Event Ticketing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 2.3.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El complemento Ticketmeo \u2013 Sell Tickets \u2013 Event Ticketing para WordPress es vulnerable a Cross-Site Scripting Almacenado a trav\u00e9s de los shortcodes del complemento en todas las versiones hasta la 2.3.6 y incluida, debido a la falta de entrada desinfecci\u00f3n y al escape de salida en los atributos proporcionados por el usuario. Esto hace posible que atacantes autenticados, con acceso de nivel de colaborador y superior, inyecten scripts web arbitraria en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-0507", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-01-31T05:15:10.280", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/ploxel/tags/2.2.0/ploxel.php#L49"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3231203/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/149edbdf-4a27-4d79-8dd1-b5b3efbf648b?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-28T03:44:17.534641+00:00", "value": {"mitigation_remediation": ["Update the Ticketmeo plugin to the latest available version, which removes the uncontrolled shortcode attribute processing.", "If an update is not possible, remove or disable shortcode usage by contributors, or withdraw contributor privileges on the site to prevent injection", "Implement custom code to escape output from shortcodes using WordPress functions such as esc_js or esc_html to mitigate potential future injection points"], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "Vulnerable installations are WordPress sites running any Ticketmeo \u2013 Sell Tickets \u2013 Event Ticketing plugin version up to and including 2.3.6. No specific WordPress core version is implicated, but any site using those plugin releases is affected.", "description_and_impact": "The Ticketmeo \u2013 Sell Tickets \u2013 Event Ticketing plugin contains a stored cross\u2011site scripting flaw that allows an attacker with contributor\u2011level or higher WordPress access to inject arbitrary JavaScript into pages through the plugin\u2019s shortcode attributes. The injected script is saved and executed whenever any user views a page containing the shortcode, enabling potential defacement, credential theft, or session hijacking. This attack leverages insufficient input sanitisation and output escaping on the plugin\u2019s attributes, directly compromising the confidentiality and integrity of user interactions within the site.", "risk_and_exploitability": "The CVSS score of 6.4 indicates moderate severity. The EPSS score is below 1\u202f%, reflecting a low probability of exploitation, and the vulnerability is not listed in CISA\u2019s KEV catalog. Exploitation requires authenticated contributor or higher access, so the attack surface is limited to privileged users or compromised contributor accounts. If an attacker achieves this, the embedded script will execute client\u2011side and can be used for data theft or to spread malicious payloads to other visitors."}}}}, "created": "2026-04-28T03:45:20.284470+00:00", "updated": "2026-04-28T03:45:20.284488+00:00", "vendors": []}