Is there a patch available for CVE-2026-13314?

Yes, a patch is available for CVE-2026-13314. Update the affected software to the latest version immediately.

pretix-digital CVE-2026-13314

Q: What is the CVSS score of CVE-2026-13314?

CVE-2026-13314 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-39412 LOW

Basic XSS (CWE-80)

2026-06-25 rami.io

GHSA-4p6m-xxpw-9r8j

XSS Pretix Pretix Digital

2.0

CVSS 4.0 · Vendor: rami.io

Severity by source

Vendor (rami.io) PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.0 MEDIUM

PR:H reflects high-privilege operator requirement; AC:H maps the AT:P preconditions; S:C captures cross-browser XSS scope change; no availability impact applies to HTML injection.

3.1 AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (rami.io).

CVSS VectorVendor: rami.io

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Patch available

Jun 25, 2026 - 16:03 EUVD

Analysis Generated

Jun 25, 2026 - 15:17 vuln.today

DescriptionCVE.org

Malicious HTML content could be injected into the content rendered by the pretix-digital plugin.

AnalysisAI

HTML injection in the pretix-digital Pretix ticketing plugin (CWE-80) allows high-privileged operators to embed malicious script-bearing HTML into event content that subsequently executes in the browsers of end users viewing rendered ticket or event pages. All versions of the plugin are indicated as affected per the CPE wildcard, with a vendor fix shipped in the 2026.5.2 release. No public exploit has been identified at time of analysis, the vulnerability is absent from the CISA KEV catalog, and the low CVSS 4.0 score of 2.0 reflects the high privilege and specific preconditions required for exploitation.

Technical ContextAI

The pretix-digital plugin extends the open-source Pretix event ticketing platform with digital ticket delivery and event content presentation. The vulnerable component (CPE: cpe:2.3:a:pretix:pretix-digital:*:*:*:*:*:*:*:*) fails to properly neutralize script-related HTML tags introduced into content fields before rendering them to end users, matching CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page). Unlike a classic stored XSS where low-privileged user input is persisted unsanitized, this variant is gated behind high-privilege access: a Pretix operator must actively place the malicious HTML into a plugin-controlled content area. The injected content is then rendered by the application and interpreted by victims' browsers.

RemediationAI

Upgrade the pretix-digital plugin to version 2026.5.2 or later as documented in the vendor release blog at https://pretix.eu/about/en/blog/20260625-release-2026-5-2/. If an immediate upgrade is not feasible, enforce strict role separation by ensuring that only fully trusted administrators hold the Pretix operator permissions required to configure plugin content fields, thereby eliminating the insider or compromised-account threat vector entirely. As an additional layer, deploying a strict Content Security Policy (CSP) on the Pretix server that blocks inline script execution (script-src 'self') will limit the browser-side impact of any injected payloads; note that this may require regression testing to confirm no legitimate plugin functionality relies on inline scripts.