CVE-2026-13225 — Stored XSS in ticket confirmation page
Malicious HTML content could be injected into the email address of an order, which pretix showed without sanitization on the confirmation page for individual tickets in that o…
Published: 2026-06-25 · CVSS: 5.3 · CVSS 4.0
Malicious HTML content could be injected into the email address of an order, which pretix showed without sanitization on the confirmation page for individual tickets in that order.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7