CVE-2026-13754

Name of the Vulnerable Software and Affected Versions Tickera – Sell Tickets & Manage Events versions prior to 3.6.0.1

Description An issue exists where authenticated attackers with custom-level access and above can perform a generic SQL Injection. This occurs due to insufficient escaping of user-supplied data and a lack of proper preparation of the SQL query. By manipulating the s parameter, an attacker can append additional SQL queries to extract sensitive information from the database.

Recommendations Update the plugin to a version newer than 3.6.0.0. Avoid using the s parameter until the update is applied.