CVE-2024-9866

Summary

CVE-2024-9866 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Event Tickets with Ticket Scanner plugin for WordPress. The flaw, present in all versions up to 2.4.4, stems from insufficient input sanitization and output escaping in the 'data' parameters. Attackers with subscriber-level access or higher can exploit this vulnerability to inject arbitrary web scripts into pages. These scripts will execute each time a user accesses the affected page, posing a significant security risk. The missing authorization aspect of this issue was addressed in version 2.4.1, while the full XSS vulnerability was resolved in version 2.4.4.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.