MEDIUM
CVE-2026-13225
CVSS
5.3
Description
Malicious HTML content could be injected into the email address of an
order, which pretix showed without sanitization on the confirmation page
for individual tickets in that order.
Summary dbcve.org
This is a stored Cross-Site Scripting (XSS) vulnerability in pretix where malicious HTML injected into an order's email address field is rendered without sanitization on the ticket confirmation page. When other users view the confirmation page, the embedded script executes in their browser context.
Mitigation
Implement output encoding/sanitization (HTML encoding) on the email address field when rendering it on the confirmation page to prevent script execution.
Weakness (CWE)
CWE-80
EPSS Score
0.44%
Probability of exploitation in next 30 days
38th percentile
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.