CVE-2026-7176 is an improper neutralization of input during web page generation (CWE-79) vulnerability in Crocantickets Entradium. Specifically, the Help text and Title parameters in the /events/<event_name>-<event_city>/custom_form/edit endpoint do not properly sanitize user input, enabling injection of JavaScript code. This malicious script executes on the public ticket purchase page for the event, potentially impacting users viewing that page. The vulnerability is rated medium severity with a CVSS 4.0 base score of 4.8. No patch or remediation information is provided in the available data.

Successful exploitation allows an attacker with low privileges to inject JavaScript code into event ticket sales forms, which executes in the context of the public ticket purchase page. This could lead to typical XSS impacts such as session hijacking or content manipulation. However, the vulnerability requires user interaction and low complexity to exploit. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when entering data into the affected parameters and consider implementing input validation or output encoding on their own if possible. Monitor vendor communications for updates on patches or official fixes.