CVE-2026-13225

MEDIUM

pretix - Stored XSS in Ticket Confirmation Page

Title source: rule

Description

Malicious HTML content could be injected into the email address of an order, which pretix showed without sanitization on the confirmation page for individual tickets in that order.

References (1)

Core 1

Core References

https://pretix.eu/about/en/blog/20260625-release-2026-5-2/

Scores

CVSS v4 5.3

EPSS 0.0034

EPSS Percentile 27.1%

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-80

Status published

Products (3)

pretix/pretix < 2026.3.4

pretix/pretix 2026.4.0 - 2026.4.4

pretix/pretix 2026.5.0 - 2026.5.2

Published Jun 25, 2026

Tracked Since Jun 25, 2026