This vulnerability (CWE-80) allows an attacker to inject malicious HTML content into the output rendered by the pretix-digital plugin. The issue arises from insufficient sanitization or neutralization of script-related HTML tags, enabling basic cross-site scripting attacks. The CVSS 4.0 base score is 2.0, indicating low severity with network attack vector, low impact on confidentiality, integrity, and availability, and requiring privileges and user interaction for exploitation. No affected versions or patches are explicitly stated, and no known exploits are reported in the wild.

An attacker with privileges and requiring user interaction could inject malicious HTML content into the pretix-digital plugin's rendered pages, potentially leading to limited cross-site scripting effects. The impact on confidentiality, integrity, and availability is low according to the CVSS vector. No evidence of active exploitation is known.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround is currently documented. Users should monitor vendor communications for updates and apply any forthcoming patches promptly.