Vulnerabilities > Liquidweb > Event Tickets > 4.3.2

DATE CVE VULNERABILITY TITLE RISK
2025-01-30 CVE-2024-13457 Authorization Bypass Through User-Controlled Key vulnerability in Liquidweb Event Tickets
The Event Tickets and Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.18.1 via the tc-order-id parameter due to missing validation on a user controlled key.
network
low complexity
liquidweb CWE-639
5.3
5.3
2019-09-08 CVE-2019-16120 Improper Neutralization of Formula Elements in a CSV File vulnerability in Liquidweb Event Tickets
CSV injection in the event-tickets (Event Tickets) plugin before 4.10.7.2 for WordPress exists via the "All Post> Ticketed > Attendees" Export Attendees feature.
network
low complexity
liquidweb CWE-1236
8.8
8.8