Quick answers
- Is CVE-2026-7176 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-7176 being exploited in the wild.
- How severe is CVE-2026-7176?
- Informational severity, published 1 October 2026.
- Which products and versions are affected?
- Crocantickets Entradium.
- Is there a fix for CVE-2026-7176?
- Yes: fixed in 20260409151659, 20260409153543. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-7176 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-7176?
- Check whether you run Crocantickets Entradium. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 20260409151659, 20260409153543
Technical details
Stored XSS vulnerability in the Help text and Title parameters of the /events/<event_name>-<event_city>/custom_form/edit endpoint allows authenticated users with UI interaction to inject JavaScript that persists and executes on the public ticket purchase page. The attacker gains the ability to steal customer session tokens or interfere with the ticket purchase workflow.
Affected products
- Crocantickets Entradium
Timeline
- 2026-10-01: disclosed