The vulnerability allows a malicious attacker to embed arbitrary HTML or script content into the email address field of an order. Pretix stored this input unchanged on the ticket confirmation page for individual tickets, enabling a stored XSS attack. An attacker who can create or modify an order can insert JavaScript that runs in the browser of anyone who views the confirmation page, allowing session hijacking, credential theft, or defacement of the site.

The affected product is pretix, an event‑ticketing platform. No specific version numbers are provided in the advisory, so any deployment of pretix that has not been updated past the release referenced in the vendor link is potentially vulnerable.

The CVSS score of 5.3 indicates moderate severity. No EPSS score is available, so the exploit probability is unknown. The vulnerability is not listed in CISA's KEV catalog. The likely attack vector is an attacker’s ability to submit a crafted order with a malicious email address; the exploitation requires a user to view the confirmation page resulting in script execution in that user’s browser. Because the vulnerability stores the payload, it can affect all users who later view the ticket confirmation page.