CVE-2026-13755

Name of the Vulnerable Software and Affected Versions Tickera – Sell Tickets & Manage Events versions prior to 3.6.0.1

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts through the price wrapper shortcode attribute. These scripts execute when a user visits the affected page, provided the victim has the referenced ticket ID in their cart cookie, meaning the payload only triggers for users who previously added that specific ticket to their cart.

Recommendations Update Tickera – Sell Tickets & Manage Events to version 3.6.0.1 or later.