CVE-2026-13225 — Stored XSS in ticket confirmation page

CVE-2026-13225

Stored XSS in ticket confirmation page PUBLISHED

Description (CNA)

Malicious HTML content could be injected into the email address of an order, which pretix showed without sanitization on the confirmation page for individual tickets in that order.

Affected (CNA)

Vendor / product	Versions
pretix / pretix	affected 0 before 2026.3.4; affected 2026.4.0 before 2026.4.4; affected 2026.5.0 before 2026.5.2

CWE

CWE-80

References

https://pretix.eu/about/en/blog/20260625-release-2026-5-2/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.