Ticket Spot – Event Tickets, RSVPs & Calendar
Ticket Spot – Event Tickets, RSVPs & Calendar has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Ticket Spot – Event Tickets, RSVPs & Calendar has a vendor fix available, so running the current release closes it.
All of these findings were reported by Gilang - DJ. Ticket Spot – Event Tickets, RSVPs & Calendar is installed on roughly 40 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2025-9875Event Tickets, RSVPs, Calendar <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records

Ticket Spot – Event Tickets, RSVPs & Calendar
Author
ticketspot
Add event ticketing to WordPress with one shortcode — and keep checkout on your own site. Ticket Spot connects your WordPress site to your Ticket Spot account. Build a widget in the dashboard, paste one shortcode into any page or post, and visitors browse events, choose tickets and pay without ever leaving your domain. How it works Install and activate this plugin (it is free, and it stays free). Go to Settings → Ticket Spot and sign in. In your Ticket Spot dashboard, build a widget — a calendar layout or a list of events — and copy its widget ID. Paste [ticket_spot widget_id="your-widget-id"] into any page, post or block. That is the whole setup. widget_id is the only attribute the shortcode takes: what the widget shows and how it looks are properties of the widget, set once in the dashboard, so you never edit the shortcode again to change the design. Your events stay in your Ticket Spot account Nothing about your events is stored in WordPress. A theme update or a plugin conflict cannot corrupt an order or interrupt a sale that is mid-checkout. What you get on every plan, including Free Embedded checkout on your own page — no redirect to a third-party checkout domain Free tickets and RSVPs from the moment you sign up Event categories, so one widget can show a subset of your events Ticket pricing and capacity controls Import your existing events from Eventbrite, Ticket Tailor or TicketSpice Invite team members to help manage events What you get on paid plans Paid tickets and pay-what-you-want tickets, with your own payment processor connected so funds reach your account directly (Professional and above) PDF tickets with QR codes, plus Apple Wallet and Google Wallet passes (Professional) Mobile scan app for iOS and Android to check attendees in at the door (Professional) Fonts and colour customization so the widget sits inside your theme (Professional) Registration questions at checkout — dietary needs, T-shirt sizes, anything (Professional) Confirmation and reminder emails, sent automatically (Professional) SMS confirmations, reminders and announcements to attendees Promo codes, percentage or fixed amount (Professional) Attendee CSV export (Professional) Timed entry tickets and arrival windows (Professional) Zoom, Google Calendar and Twitch integrations (Professional) Waitlists, group tickets and digital waivers (Business) Interactive seating charts with rows, tables and sections (Business) Custom branding — your logo and colours on tickets, emails and pages (Business) Sales, check-in and page-view analytics (Business) Self check-in kiosk mode and on-site POS ticket sales (Business) Zapier (Business), Mailchimp (Business+) Full white-label mode and custom domains (Business+) Pricing Ticket Spot charges 0% platform fees — your payment processor charges its standard transaction fees and nothing is added on top. The Free plan covers up to 20 attendees a month. Paid plans start at $29.99/month. Full breakdown: https://ticketspotapp.com/pricing Who it is for Community centres, churches, music venues, theatres, museums, training businesses, conferences and fundraisers — anyone who already has a WordPress site and would rather not send buyers to someone else’s platform. Learn more: https://ticketspotapp.com/integrations/sell-tickets-on-wordpress
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C