From 848f7fa0e59d6dc09defeffcd0eb4e505408d2ee Mon Sep 17 00:00:00 2001
From: Mira Weller <weller@rami.io>
Date: Fri, 19 Jun 2026 13:31:09 +0200
Subject: [PATCH] [SECURITY] Fix stored XSS in ticket confirmation page
 (CVE-2026-13225)

---
 src/pretix/presale/templates/pretixpresale/event/position.html | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/pretix/presale/templates/pretixpresale/event/position.html b/src/pretix/presale/templates/pretixpresale/event/position.html
index a8b735f10..2a89b69ee 100644
--- a/src/pretix/presale/templates/pretixpresale/event/position.html
+++ b/src/pretix/presale/templates/pretixpresale/event/position.html
@@ -4,6 +4,7 @@
 {% load eventsignal %}
 {% load money %}
 {% load eventurl %}
+{% load wrap_in %}
 {% block title %}{% trans "Registration details" %}{% endblock %}
 {% block content %}
     <h2 class="h1">
@@ -48,7 +49,7 @@
         </div>
         <div class="panel-body">
             <p>
-                {% blocktrans trimmed with email="<strong>"|add:order.email|add:"</strong>"|safe %}
+                {% blocktrans trimmed with email=order.email|wrap_in:"strong" %}
                     This order is managed for you by {{ email }}. Please contact them for any questions regarding
                     payment, cancellation or changes to this order.
                 {% endblocktrans %}