CVE-2026-13225CWE-80
Stored XSS in ticket confirmation page
Medium · published June 25, 2026
What it is
Malicious HTML content could be injected into the email address of an
order, which pretix showed without sanitization on the confirmation page
for individual tickets in that order.
The record
Technical detail
- CVSS v4.0
- 5.3 · MEDIUM
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L
- EPSS
- 0.00444 · 37.5th percentile
- Weakness
- CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
- Published
- 2026-06-25T14:26Z
EPSS history
Timeline