XSS in Pretix

CVE-2026-13225

Malicious HTML content could be injected into the email address of an order, which pretix showed without sanitization on the confirmation page for individual tickets in that order.

EPSS: 0.003 (27.0th percentile) — read the EPSS interpretation.