CVE-2026-7421: Passeum Ticketing WordPress Plugin Stored XSS Vulnerability

Technical summary

The vulnerability stems from two validation failures in the Passeum Ticketing plugin. The `get_shop_url()` method returns the `shop_name` configuration value without sanitization when it begins with 'http://' or 'https://', and the `validate_shop_name()` function only performs basic checks (empty value and type validation) without verifying that the URL points to a legitimate, trusted domain. An authenticated attacker with Administrator privileges exploits this by setting the shop_name to a malicious URL. The plugin then calls `wp_register_script()` and `wp_register_style()` with that URL, causing WordPress to enqueue external resources from the attacker's domain. These resources execute in the browser context of every site visitor on any page displaying a Passeum Ticketing shortcode, achieving persistent malicious script injection.

Business impact

Compromise of a Passeum Ticketing-enabled WordPress multisite installation could result in malware distribution, credential harvesting, or defacement affecting all site visitors. Since the injected scripts run on every frontend page with a shortcode, the attack surface is broad—potentially impacting user accounts, sensitive information capture, and site reputation. The vulnerability requires admin-level access, limiting exposure to compromised admin accounts, disgruntled employees, or sites using weak administrative credentials. Single-site WordPress installations are not affected due to WordPress's built-in unfiltered_html capability for administrators.

Affected systems

Passeum Ticketing plugin for WordPress, all versions up to and including 1.0. The vulnerability is relevant only to multisite WordPress installations (WordPress Multisite mode enabled). Single-site installations are not vulnerable due to WordPress's permission model. Any WordPress multisite deployment using this plugin with administrator-role users is at potential risk.

Exploitability

Exploitation requires authenticated access with Administrator-level privileges on the WordPress multisite installation, making opportunistic external attacks unlikely. However, the attack is trivial to execute once administrative access is gained—a single configuration change to the shop_name setting is sufficient. The vulnerability is high-impact if an admin account is compromised or if a disgruntled admin intentionally injects malicious content. The attack is silent and persistent, affecting all site visitors without additional trigger conditions.

Remediation

Update the Passeum Ticketing plugin to a patched version that implements proper input validation and sanitization of the shop_name setting. Verify against the vendor's security advisory for the exact patched version number. Until a patch is available, restrict WordPress administrator role assignments to trusted users only, enforce strong authentication (multi-factor authentication), and monitor admin account activity for unauthorized configuration changes. Consider using WordPress security plugins that alert on changes to plugin settings or enqueued external resources.

Patch guidance

Consult the official Passeum Ticketing plugin repository or vendor website for the patched version addressing this vulnerability. Apply updates promptly to all affected WordPress multisite instances. Verify the patch version against the vendor's official security advisory before deploying. Test the patch in a staging environment to confirm compatibility with other plugins and themes before production deployment.

Detection guidance

Check the Passeum Ticketing plugin's shop_name configuration setting in your WordPress database (typically wp_options table for multisite networks) for any unexpected external URLs. Review network-level plugin settings and audit admin configuration changes in your WordPress audit logs if available through security plugins. Monitor frontend pages for externally loaded resources from unexpected domains using browser developer tools or security scanning services. Use server-side web application firewalls to detect and alert on requests loading scripts from untrusted external sources tied to your WordPress domain.

Why prioritize this

Although assigned a MEDIUM severity score due to requiring high-privilege authentication, this vulnerability warrants timely attention because it enables persistent malicious script injection affecting all site visitors if an admin account is compromised. Multisite WordPress deployments hosting user-facing services, e-commerce, or community content are especially at risk. The low barrier to exploitation once admin access is obtained and the potential for broad visitor impact justify prompt patching before widespread adoption of the vulnerable plugin version.

Risk score, explained

The CVSS 3.1 score of 4.4 (MEDIUM) reflects the high-privilege prerequisite (PR:H) and high attack complexity (AC:H) due to the need for administrative access and the multisite-only applicability. However, the network-wide scope (S:C) and confidentiality/integrity impact (C:L/I:L) indicate real risk. The score does not capture the scenario of a compromised admin account or insider threat, which would represent substantially higher practical risk in some environments.

Frequently asked questions