Pretalx, a conference planning tool, contains a stored cross‑site scripting flaw in the organizer search typeahead. Submission titles, speaker display names, and user names/emails that are rendered with innerHTML allow any user who can set those fields—such as a registered user whose display name is displayed to an organizer—to embed HTML or JavaScript. When an organizer performs a search that matches the malicious record, the injected script runs inside the organizer’s browser, enabling attackers to hijack sessions, exfiltrate data, or perform other malicious actions with the organizer’s privileges.

All installations of pretalx before version 2026.1.0 are affected. The vulnerability exists on the backend component of the pre‑2026.1.0 releases.

The CVSS score of 8.7 indicates high severity, but the EPSS score of less than 1% suggests that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require the attacker to control one of the affected fields and for an organizer to perform a matching search; the attack can be carried out via the web interface without additional privileges beyond those used to submit or assign speakers.