The plugin does not validate the tribe_tickets_redirect_to parameter before redirecting the user to the given value, leading to an arbitrary redirect issue
https://exampel.com/wp-admin/admin.php?page=wp_ajax_rsvp-form&tribe_tickets_redirect_to=https://wpscan.com