CVE-2026-13225: Stored XSS in ticket confirmation page
Published Jun 25, 2026
·Updated
Malicious HTML content could be injected into the email address of an order, which pretix showed without sanitization on the confirmation page for individual tickets in that order.
Affected Software
1 affected component
pretix pretix
Event History
Jun 25, 2026
CVE Published
via MITRE·02:26 PM
Data Sourced
via MITRE·02:26 PM
DescriptionWeakness
Data Sourced
via NVD·03:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-13225?
CVE-2026-13225 has a risk level of 32, indicating a moderate severity vulnerability.
2
How do I fix CVE-2026-13225?
To fix CVE-2026-13225, ensure that user input in email addresses is properly sanitized before being displayed on the confirmation page.
3
What type of vulnerability is CVE-2026-13225?
CVE-2026-13225 is classified as a Stored Cross-Site Scripting (XSS) vulnerability.
4
What software is affected by CVE-2026-13225?
CVE-2026-13225 affects the pretix ticketing software.
5
What could an attacker achieve by exploiting CVE-2026-13225?
An attacker could inject malicious HTML content that executes in the user's browser when they view the ticket confirmation page.