CVE-2026-7174 is a stored XSS vulnerability in Entradium by Crocantickets. The issue resides in improper input neutralization of the Name and Field parameters at the /tools/discount_wizard/discount_config endpoint during discount creation. Injected JavaScript executes upon viewing the event discount list page, enabling remote attackers to craft URLs that can steal session data from victims. The CVSS 4.8 score reflects network attack vector, low attack complexity, no privileges required, but user interaction needed, and limited impact on confidentiality and integrity.

Successful exploitation allows remote attackers to inject and execute arbitrary JavaScript in the context of the affected web application. This can lead to theft of session data from users who visit a maliciously crafted URL. The impact is limited to session data exposure and does not indicate further system compromise or data integrity loss.

No official patch or remediation guidance is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution with URLs related to event discount pages and consider applying web application firewall rules to detect and block suspicious input patterns targeting the affected parameters.