Is CVE-2026-13225 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-13225 being exploited in the wild.

How severe is CVE-2026-13225?

Informational severity, with a CVSS score of 5.3, published 25 June 2026.

Which products and versions are affected?

Rami.Io Pretix < 2026.3.4, 2026.4.0 to < 2026.4.4, 2026.5.0 to < 2026.5.2.

Is there a fix for CVE-2026-13225?

A patch was published on 2026-06-25. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-13225 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-13225?

Check whether you run Rami.Io Pretix at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-13225: rami.io pretix stored XSS in ticket confirmation page

Q: Which products and versions are affected?

Rami.Io Pretix < 2026.3.4, 2026.4.0 to < 2026.4.4, 2026.5.0 to < 2026.5.2.

Q: Is there a fix for CVE-2026-13225?

A patch was published on 2026-06-25. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-13225 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-13225?

Check whether you run Rami.Io Pretix at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-13225 · Severity: info · CVSS 5.3 · Published 2026-06-25

pretix is an open-source ticketing and event management platform. A security flaw allowed attackers to inject malicious code into the email address field of an order, which would then be executed when a user viewed the ticket confirmation page. This could potentially lead to unauthorized actions being performed in the user's browser or the theft of session information, particularly if security headers have been weakened by third-party tracking plugins.

Technologies: Rami.Io Pretix. Vendors: Rami.Io.

Quick answers

Is CVE-2026-13225 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-13225 being exploited in the wild.
How severe is CVE-2026-13225?: Informational severity, with a CVSS score of 5.3, published 25 June 2026.
Which products and versions are affected?: Rami.Io Pretix < 2026.3.4, 2026.4.0 to < 2026.4.4, 2026.5.0 to < 2026.5.2.
Is there a fix for CVE-2026-13225?: A patch was published on 2026-06-25. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-13225 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-13225?: Check whether you run Rami.Io Pretix at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in pretix due to improper neutralization of input in the email address field of an order (CWE-80). The application fails to sanitize this input before displaying it on the individual ticket confirmation pages. An unauthenticated attacker can provide a malicious payload during the checkout process. While pretix generally employs a strong Content Security Policy (CSP), the vendor notes that this specific page's CSP may be weakened by certain tracking plugins, increasing the risk of script execution. The vulnerability is fixed in versions 2026.3.4, 2026.4.4, and 2026.5.2.

Affected products

rami.io pretix < 2026.3.4, 2026.4.0 to < 2026.4.4, 2026.5.0 to < 2026.5.2

Timeline

2026-06-25: disclosed: Discovered internally by the vendor.
2026-06-25: patched
2026-06-25: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.