WP Manifestindependent plugin directory
manifest / events / tribe-ext-tickets-additional-fields

Event Tickets Extension: Additional Fields WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC- #5 in Events & Booking

Add fields to your Tickets or RSVPs.

★ 3stars
1.1krelease downloads
≈350active sites
1.1.0latest · 1 year ago

Install

Download tribe-ext-tickets-additional-fields-1.1.0.zip From the 1.1.0 release on GitHub, Jan 31, 2025

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/mt-support/tribe-ext-tickets-additional-fields/releases/download/1.1.0/tribe-ext-tickets-additional-fields-1.1.0.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

What and Why?

This is an extension to add additional fields for Tickets and RSVPs. Event Tickets and Event Tickets Plus are required.

How?

You can add the following code to another plugin or in your theme functions.php file:

<?php

add_filter( 'tribe_ext_tickets_additional_fields', 'custom_tickets_additional_fields' );

function custom_tickets_additional_fields( $ticket_fields ) {

        $ticket_fields['teacher_name'] = [
            'type'        => 'text',
            'label'       => esc_html__( 'Teacher name' ),
            'description' => esc_html__( 'Insert the name of the teacher or person hosting.' ),
        ];

        $ticket_fields['teacher_email'] = [
            'type'        => 'email',
            'label'       => esc_html__( 'Teacher email' ),
            'description' => esc_html__( 'Insert the email of the teacher or person hosting.' ),
        ];

        $ticket_fields['teacher_id'] = [
            'type'        => 'number',
            'label'       => esc_html__( 'Teacher ID' ),
            'description' => esc_html__( 'Insert the Teacher ID number.' ),
        ];

        $ticket_fields['is_mandatory'] = [
            'type'        => 'checkbox',
            'label'       => esc_html__( 'Is mandatory' ),
            'description' => esc_html__( 'Check box if attendance is mandatory' ),
        ];

        $ticket_fields['zoom_link'] = [
            'type'        => 'url',
            'label'       => esc_html__( 'Zoom link' ),
            'description' => esc_html__( 'Insert the zoom link to share a link of the meeting.' ),
        ];

        $ticket_fields['youtube_embed'] = [
            'type'        => 'textarea',
            'label'       => esc_html__( 'Youtube Embed' ),
            'description' => esc_html__( 'Insert the youtube embed of the video they have access to when they purchase the ticket.' ),
        ];

        return $ticket_fields;
}

This way the additional fields will be added on the ticket box or the RSVP box under the "Additional Fields" section.

On a code basis, there's a template tag called tribe_ext_tickets_additional_fields_get_meta() that will allow you to get the value wherever you need it, like this:

// Replace `123` with your ticket ID.
tribe_ext_tickets_additional_fields_get_meta( 123, 'zoom_link' );

Printing the fields

You can either use a template tag, or you can also use the the [tribe_tickets_additional_field] shortcode if you also have the Event Tickets Shortcodes Extension.

Using the template tag

You can use the function tribe_ext_tickets_additional_fields_get_meta() in your code, like this:

// Replace `123` with your ticket ID.
tribe_ext_tickets_additional_fields_get_meta( 123, 'zoom_link' );

Using the Shortcode

As mentioned above. For this to work you'll need Event Tickets Plus installed and active on your site.

The shortcode has two required parameters, the ticket_id and the field. The ticket_id parameter is the ID of the ticket (post or page. The field parameter is the ID you use when defining the field. In the previous example: zoom_link, teacher_name, teacher_email and youtube_embed.

Example usage:

[tribe_tickets_additional_field ticket_id="123" field="zoom_link"]

Where 123 is the ID of the ticket

Finally, if by any chance you want to modify the output of the shortcode you can hook into the tribe_tickets_additional_field_shortcode_html filter, which parameters are the $html, $ticket_id and $field.

add_filter( 'tribe_tickets_additional_field_shortcode_html', 'my_custom_additional_field_shortcode_printing', 10, 3 );

function my_custom_additional_field_shortcode_printing( $html, $ticket_id, $field ) {

    if ( 'zoom_link' === $field ) {
        $html = 'I do not want to print any zoom link!';
    }

    if ( 123 === $ticket_id ) {
        $html = 'I do not want to print any field for the ticket 123';
    }

    return $html;
}

Supported fields

  • text - Text.
  • textarea - Textarea.
  • url - URL (when being printed for the shortcode will add the HTML for the link).
  • email - Email (when being printed for the shortcode will add the HTML for the email link).
  • number - Number.
  • checkbox - Checkbox.

Releases

3 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
1.1.0 latest
Jan 31, 2025 1 year ago
tribe-ext-tickets-additional-fields-1.1.0.zip
397
Jun 24, 2023 3 years ago
tribe-ext-tickets-additional-fields-1.0.2.zip
706
Jan 21, 2021 5 years ago
tag only
—

Active-site estimate ≈350 comes from the median of recent superseded releases. Method.

C- grade

Security

Event Tickets Extension: Additional Fields 1.1.0 · audited by WP Registry

High-severity findings.

1 high
Audited release
1.1.0
Findings
1
Worst severity
high
Content hash
5dce9ff8bc8a8f0941e4b0e3…

Findings

  • high Stored XSS via unsanitized ticket additional fields printed by the public shortcode

    xss_stored

    Fields::save_fields() persists Event Tickets ticket-editor values for every registered additional field through update_post_meta with no sanitization except floatval for number and a 0/1 flag for checkbox. The parent AJAX (wp_ajax_tribe-ticket-add) is gated only by Event Tickets' add_ticket_nonce plus edit_post/edit_others_posts/edit_event_tickets, so an Author (or a Contributor on a draft later published) who can open the classic ticket metabox can store arbitrary HTML in _tribe_tickets_meta_*. The public shortcode [tribe_tickets_additional_field] then prints that meta: url and email are concatenated into <a href> / mailto: with no esc_url/esc_attr/esc_html (attribute breakout and javascript: URLs), and the default branch returns the raw string (script tags and event-handler markup execute in the page body). WordPress kses does not run on shortcode output, and Authors do not have unfiltered_html, so this is a stored XSS kses bypass on any published post, event, or widget that contains the shortcode. Textarea is documented as a YouTube-embed field, which explains raw HTML for that type, but url/email/text have no such contract and textarea is still not passed through wp_kses. Admin metabox templates correctly use esc_attr/esc_html; only the frontend shortcode is the executing consumer.

    src/Tribe/Shortcodes/Tribe_Tickets_Additional_Field.php:79-88,112-116,128-132

    Recommendation

    Sanitize on save by type (sanitize_text_field / sanitize_textarea_field / esc_url_raw / sanitize_email / floatval / 0|1). On output, use esc_url() and esc_html() in get_url_render/get_email_render, esc_html() for text/number/checkbox, and wp_kses() with an embed allowlist for textarea instead of echoing raw HTML. Reject javascript: and data: URLs.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.