This vulnerability (CVE-2026-57534) in the pretix-pages plugin involves improper neutralization of script-related HTML tags (CWE-80), enabling injection of malicious HTML content into page content. The issue is classified as a basic cross-site scripting (XSS) vulnerability. The CVSS 4.0 base score is 2.1, reflecting low severity, with attack vector network, low impact on confidentiality, integrity, and availability, and requiring high privileges with no user interaction. Affected versions are all versions before 1.6.4. There is no vendor advisory or patch available at this time, and no known exploits in the wild.

An attacker with high privileges can inject malicious HTML content into pages managed by the pretix-pages plugin, potentially leading to script execution in the context of users viewing the affected pages. The impact is limited due to the requirement for high privileges and the low CVSS score, indicating limited confidentiality, integrity, and availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict high privilege access to trusted users only and review content input sanitization policies to minimize injection risk.