Log in Start free

Vulnerability · Published Mar 5, 2026 · Assigned by GitHub_M

CVE-2026-28223Wagtail: Improper escaping of HTML (Cross-site Scripting) in simple_translation admin interface

Medium 6.1

In plain English

A medium-severity cross-site scripting in wagtail from wagtail. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.5%top 54.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on confirmation messages within the wagtail.contrib.simple_translation module. A user with access to the Wagtail admin area may create a page with a specially-crafted title which, when another user performs the "Translate" action, causes arbitrary JavaScript code to run. This could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIwagtail6.3.8GHSA-p4v8-rw59-93cq
PyPIwagtail7.0.6GHSA-p4v8-rw59-93cq
PyPIwagtail7.2.3GHSA-p4v8-rw59-93cq
PyPIwagtail7.3.1GHSA-p4v8-rw59-93cq
PyPIwagtail6.3.8, 7.0.6, 7.2.3PYSEC-2026-2308

Affected products (as reported)

VendorProductVersions
wagtail wagtail < 6.3.8>= 6.4rc1, < 7.0.6>= 7.1rc1, < 7.2.3>= 7.3rc1, < 7.3.1

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

References