Medium severity · published Jun 25, 2026
CVE-2026-13225
Stored XSS in ticket confirmation page
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
Malicious HTML content could be injected into the email address of an
order, which pretix showed without sanitization on the confirmation page
for individual tickets in that order.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PR
pretix · pretix
before 2026.3.4; 2026.4.0 before 2026.4.4; 2026.5.0 before 2026.5.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-13225
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-13225
pretix.eu
https://pretix.eu/about/en/blog/20260625-release-2026-5-2/
More from pretix
9.8
CVE-2024-27447
pretix before 2024.1.1 mishandles file validation
8.8
CVE-2026-57532
Malicious HTML content contained in the layout specification of a PDF ticket or badge layout was executed when the PDF editor is opened in the browser
7.7
CVE-2026-13602
Session takeover vulnerability
6.5
CVE-2026-2452
Unsafe variable evaluation in email templates
6.5
CVE-2026-2451
Unsafe variable evaluation in email templates