CVE-2026-97634

Published 2 October 2026 · tracked since 2 October 2026

Description

The Event Tickets and Registration plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 5.29.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-104606 MEDIUM 6.3
• CVE-2026-94541 CRITICAL 9.8
• CVE-2026-87920 HIGH 7.2
• CVE-2026-103552 HIGH 7.3
• CVE-2026-97663 HIGH 7.2
• CVE-2026-97338 MEDIUM 6.4
• CVE-2026-97342 HIGH 7.2
• CVE-2026-97637 CRITICAL 9.8
• CVE-2026-97641 HIGH 7.2
• CVE-2026-96566 HIGH 7.2

→ Open the live CVE board · all tools