CVE-2026-28223

Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on confirmation messages within the wagtail.contrib.simple_translation module. A user with access to the Wagtail admin area may create a page with a specially-crafted title which, when another user performs the "Translate" action, causes arbitrary JavaScript code to run. This could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1.

Published Mar 4, 2026

https://github.com/advisories/GHSA-p4v8-rw59-93cq

CVSS ScoreMedium

6.1

Ecosystem	Package	Version

Ecosystem	Package	Version

Vulnerabilities

CVE-2026-28223

Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on confirmation messages within the wagtail.contrib.simple_translation module. A user with access to the Wagtail admin area may create a page with a specially-crafted title which, when another user performs the "Translate" action, causes arbitrary JavaScript code to run. This could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1.

Published Mar 4, 2026

https://github.com/advisories/GHSA-p4v8-rw59-93cq

CVSS ScoreMedium

6.1


pypi	wagtail	0.1
pypi	wagtail	0.2
pypi	wagtail	0.3.1
pypi	wagtail	0.3
pypi	wagtail	0.4.1
pypi	wagtail	0.4
pypi	wagtail	0.5
pypi	wagtail	0.6
pypi	wagtail	0.7
pypi	wagtail	0.8.10
pypi	wagtail	0.8.1
pypi	wagtail	0.8.2
pypi	wagtail	0.8.3
pypi	wagtail	0.8.4
pypi	wagtail	0.8.5
pypi	wagtail	0.8.6
pypi	wagtail	0.8.7
pypi	wagtail	0.8.8
pypi	wagtail	0.8.9
pypi	wagtail	0.8
pypi	wagtail	1.0
pypi	wagtail	1.0b1
pypi	wagtail	1.0b2
pypi	wagtail	1.0rc1
pypi	wagtail	1.0rc2
pypi	wagtail	1.10.1
pypi	wagtail	1.10
pypi	wagtail	1.10rc1
pypi	wagtail	1.11.1
pypi	wagtail	1.11
pypi	wagtail	1.11rc1
pypi	wagtail	1.12.1
pypi	wagtail	1.12.2
pypi	wagtail	1.12.3
pypi	wagtail	1.12.4
pypi	wagtail	1.12.5
pypi	wagtail	1.12.6
pypi	wagtail	1.12
pypi	wagtail	1.12rc1
pypi	wagtail	1.13.1
pypi	wagtail	1.13.2
pypi	wagtail	1.13.3
pypi	wagtail	1.13.4
pypi	wagtail	1.13
pypi	wagtail	1.13rc1
pypi	wagtail	1.1
pypi	wagtail	1.1rc1
pypi	wagtail	1.2
pypi	wagtail	1.2rc1
pypi	wagtail	1.3.1

Ecosystem	Package	Version


pypi	wagtail	0.1
pypi	wagtail	0.2
pypi	wagtail	0.3.1
pypi	wagtail	0.3
pypi	wagtail	0.4.1
pypi	wagtail	0.4
pypi	wagtail	0.5
pypi	wagtail	0.6
pypi	wagtail	0.7
pypi	wagtail	0.8.10
pypi	wagtail	0.8.1
pypi	wagtail	0.8.2
pypi	wagtail	0.8.3
pypi	wagtail	0.8.4
pypi	wagtail	0.8.5
pypi	wagtail	0.8.6
pypi	wagtail	0.8.7
pypi	wagtail	0.8.8
pypi	wagtail	0.8.9
pypi	wagtail	0.8
pypi	wagtail	1.0
pypi	wagtail	1.0b1
pypi	wagtail	1.0b2
pypi	wagtail	1.0rc1
pypi	wagtail	1.0rc2
pypi	wagtail	1.10.1
pypi	wagtail	1.10
pypi	wagtail	1.10rc1
pypi	wagtail	1.11.1
pypi	wagtail	1.11
pypi	wagtail	1.11rc1
pypi	wagtail	1.12.1
pypi	wagtail	1.12.2
pypi	wagtail	1.12.3
pypi	wagtail	1.12.4
pypi	wagtail	1.12.5
pypi	wagtail	1.12.6
pypi	wagtail	1.12
pypi	wagtail	1.12rc1
pypi	wagtail	1.13.1
pypi	wagtail	1.13.2
pypi	wagtail	1.13.3
pypi	wagtail	1.13.4
pypi	wagtail	1.13
pypi	wagtail	1.13rc1
pypi	wagtail	1.1
pypi	wagtail	1.1rc1
pypi	wagtail	1.2
pypi	wagtail	1.2rc1
pypi	wagtail	1.3.1

Find vulnerabilities. Fix fast with AI.

CVE-2026-28223

CVE-2026-28223