CVE-2026-7176
Received Received - Intake

Stored XSS in Event Ticket Form Builder

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)

Description
CVE-2026-7176: the Help text and Title parameters in the endpoint /events/<event_name>-<event_city>/custom_form/edit during the process of creating or modifying forms associated with ticket sales for an event, which allows for the injection of JavaScript that will execute on the public ticket purchase page for the event.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-01
Last Modified
2026-10-01
Generated
2026-10-01
AI Q&A
2026-10-01
EPSS Evaluated
N/A
NVD
CVE-2026-7176
EUVD
EUVD-2026-90746

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-7176 is a vulnerability in a ticket sales system where the Help text and Title parameters in the /events/<event_name>-<event_city>/custom_form/edit endpoint can be exploited to inject JavaScript code. This injected code will execute on the public ticket purchase page for the event.

Detection Guidance

This vulnerability involves JavaScript injection in form parameters during event ticket sales setup. To detect it, inspect HTTP requests to /events/<event_name>-<event_city>/custom_form/edit for suspicious payloads in Help text and Title parameters. Check for unusual JavaScript code or HTML tags in form submissions or responses.

Impact Analysis

This vulnerability allows attackers to inject malicious JavaScript that runs when users visit the ticket purchase page. This could lead to theft of user credentials, session hijacking, or defacement of the ticket purchase page.

Compliance Impact

This vulnerability allows JavaScript injection on ticket purchase pages, which could lead to unauthorized data collection or manipulation. This may violate GDPR by exposing user data without consent and HIPAA by compromising protected health information if event data includes such details.

Mitigation Strategies

Immediately review and sanitize all inputs for the Help text and Title parameters in the /events/<event_name>-<event_city>/custom_form/edit endpoint. Implement strict input validation to prevent JavaScript injection. Ensure all user-generated content is properly escaped before rendering on public ticket purchase pages.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-7176. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart