Stored Cross-Site Scripting Vulnerability in Wagtail by Torchbox
CVE-2026-28223
What is CVE-2026-28223?
Wagtail, an open-source content management system built on Django, is susceptible to a stored cross-site scripting (XSS) vulnerability affecting its translation module. Users with admin access can craft page titles containing malicious JavaScript, leading to the execution of arbitrary code when another admin user interacts with the translation feature. This could allow attackers to perform actions under the credentials of the affected user. This vulnerability, which requires admin privileges for exploitation, has been addressed in the latest Wagtail releases. It is crucial for administrators to upgrade to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1 to mitigate this security risk.
Affected Version(s)
wagtail < 6.3.8 < 6.3.8
wagtail >= 6.4rc1, < 7.0.6 < 6.4rc1, 7.0.6
wagtail >= 7.1rc1, < 7.2.3 < 7.1rc1, 7.2.3