CVE-2026-7421

{"id": "CVE-2026-7421", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7421", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-03T13:18:04.431808Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.3}]}, "affected": [{"source": "security@wordfence.com", "affectedData": [{"vendor": "passeum", "product": "Passeum Ticketing", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-03T00:16:44.947", "references": [{"url": "https://plugins.trac.wordpress.org/browser/passeum-ticketing/tags/1.0/inc/settings.php#L141", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/passeum-ticketing/tags/1.0/passeum-ticketing.php#L202", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/passeum-ticketing/tags/1.0/passeum-ticketing.php#L40", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/passeum-ticketing/trunk/inc/settings.php#L141", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/passeum-ticketing/trunk/passeum-ticketing.php#L202", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/passeum-ticketing/trunk/passeum-ticketing.php#L40", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/48363f1f-dae8-4efa-824f-098550245ca3?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "The Passeum Ticketing plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.0. This is due to the `get_shop_url()` method returning the `shop_name` setting value without sanitization when it begins with \"http\", combined with insufficient validation in the `validate_shop_name()` function which only checks for empty values and string type. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary external scripts by setting the `shop_name` to an attacker-controlled URL (e.g., `https://attacker.com`), which causes the plugin to enqueue external JavaScript and CSS from the attacker-controlled domain via `wp_register_script()` and `wp_register_style()`. The injected scripts execute on every frontend page containing any Passeum Ticketing shortcode, affecting all site visitors. Please note that this does not affect single-site installations as administrators already have the `unfiltered_html` capability."}, {"lang": "es", "value": "El plugin Passeum Ticketing para WordPress es vulnerable a Cross-Site Scripting Almacenado en todas las versiones hasta la 1.0, inclusive. Esto se debe a que el m\u00e9todo 'get_shop_url()' devuelve el valor de la configuraci\u00f3n 'shop_name' sin sanitizaci\u00f3n cuando comienza con 'http', combinado con una validaci\u00f3n insuficiente en la funci\u00f3n 'validate_shop_name()' que solo verifica valores vac\u00edos y el tipo de cadena. Esto hace posible que atacantes autenticados, con acceso de nivel de Administrador y superior, inyecten scripts externos arbitrarios al establecer el 'shop_name' a una URL controlada por el atacante (por ejemplo, 'https://attacker.com'), lo que hace que el plugin encole JavaScript y CSS externos desde el dominio controlado por el atacante a trav\u00e9s de 'wp_register_script()' y 'wp_register_style()'. Los scripts inyectados se ejecutan en cada p\u00e1gina de frontend que contenga cualquier shortcode de Passeum Ticketing, afectando a todos los visitantes del sitio. Tenga en cuenta que esto no afecta a las instalaciones de sitio \u00fanico, ya que los administradores ya tienen la capacidad 'unfiltered_html'."}], "lastModified": "2026-07-21T19:10:00.107", "sourceIdentifier": "security@wordfence.com"}