Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-13225

Stored XSS in ticket confirmation page

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
rami.io

Description

Malicious HTML content could be injected into the email address of an order, which pretix showed without sanitization on the confirmation page for individual tickets in that order.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

pretix pretix

Default version status: unaffected

  • 0 to < 2026.3.4affected
  • 2026.4.0 to < 2026.4.4affected
  • 2026.5.0 to < 2026.5.2affected

References