Ticket Spot – Event Tickets, RSVPs & Calendar

Ticket Spot – Event Tickets, RSVPs & Calendar has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).

The one issue recorded for Ticket Spot – Event Tickets, RSVPs & Calendar has a vendor fix available, so running the current release closes it.

All of these findings were reported by Gilang - DJ. Ticket Spot – Event Tickets, RSVPs & Calendar is installed on roughly 40 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium
6.4/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all Ticket Spot – Event Tickets, RSVPs & Calendar vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2025-9875

Event Tickets, RSVPs, Calendar <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

1 records
Ticket Spot – Event Tickets, RSVPs & Calendar banner
Latestv1.0.4

Ticket Spot – Event Tickets, RSVPs & Calendar

ticketspot

Author

ticketspot

4.0(2)
80/100
Last Updated
2026-09-05 (8d ago)
Active Installs
40+
Downloads
2,623
Requires WP
5.1+
Requires PHP
7.0+
Tested up to
WP 7.1
Created
2022-04-28 (4y ago)

Add event ticketing to WordPress with one shortcode — and keep checkout on your own site. Ticket Spot connects your WordPress site to your Ticket Spot account. Build a widget in the dashboard, paste one shortcode into any page or post, and visitors browse events, choose tickets and pay without ever leaving your domain. How it works Install and activate this plugin (it is free, and it stays free). Go to Settings → Ticket Spot and sign in. In your Ticket Spot dashboard, build a widget — a calendar layout or a list of events — and copy its widget ID. Paste [ticket_spot widget_id="your-widget-id"] into any page, post or block. That is the whole setup. widget_id is the only attribute the shortcode takes: what the widget shows and how it looks are properties of the widget, set once in the dashboard, so you never edit the shortcode again to change the design. Your events stay in your Ticket Spot account Nothing about your events is stored in WordPress. A theme update or a plugin conflict cannot corrupt an order or interrupt a sale that is mid-checkout. What you get on every plan, including Free Embedded checkout on your own page — no redirect to a third-party checkout domain Free tickets and RSVPs from the moment you sign up Event categories, so one widget can show a subset of your events Ticket pricing and capacity controls Import your existing events from Eventbrite, Ticket Tailor or TicketSpice Invite team members to help manage events What you get on paid plans Paid tickets and pay-what-you-want tickets, with your own payment processor connected so funds reach your account directly (Professional and above) PDF tickets with QR codes, plus Apple Wallet and Google Wallet passes (Professional) Mobile scan app for iOS and Android to check attendees in at the door (Professional) Fonts and colour customization so the widget sits inside your theme (Professional) Registration questions at checkout — dietary needs, T-shirt sizes, anything (Professional) Confirmation and reminder emails, sent automatically (Professional) SMS confirmations, reminders and announcements to attendees Promo codes, percentage or fixed amount (Professional) Attendee CSV export (Professional) Timed entry tickets and arrival windows (Professional) Zoom, Google Calendar and Twitch integrations (Professional) Waitlists, group tickets and digital waivers (Business) Interactive seating charts with rows, tables and sections (Business) Custom branding — your logo and colours on tickets, emails and pages (Business) Sales, check-in and page-view analytics (Business) Self check-in kiosk mode and on-site POS ticket sales (Business) Zapier (Business), Mailchimp (Business+) Full white-label mode and custom domains (Business+) Pricing Ticket Spot charges 0% platform fees — your payment processor charges its standard transaction fees and nothing is added on top. The Free plan covers up to 20 attendees a month. Paid plans start at $29.99/month. Full breakdown: https://ticketspotapp.com/pricing Who it is for Community centres, churches, music venues, theatres, museums, training businesses, conferences and fundraisers — anyone who already has a WordPress site and would rather not send buyers to someone else’s platform. Learn more: https://ticketspotapp.com/integrations/sell-tickets-on-wordpress

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C