VYPR
← All advisories
Medium severity6.1NVD Advisory· Published Mar 5, 2026· Updated Jun 17, 2026

CVE-2026-28223

CVE-2026-28223

Description

Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on confirmation messages within the wagtail.contrib.simple_translation module. A user with access to the Wagtail admin area may create a page with a specially-crafted title which, when another user performs the "Translate" action, causes arbitrary JavaScript code to run. This could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
wagtailPyPI
< 6.3.86.3.8
wagtailPyPI
>= 6.4rc1, < 7.0.67.0.6
wagtailPyPI
>= 7.1rc1, < 7.2.37.2.3
wagtailPyPI
>= 7.3rc1, < 7.3.17.3.1

Affected products

5
  • Torchbox/Wagtail3 versions
    cpe:2.3:a:torchbox:wagtail:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:torchbox:wagtail:*:*:*:*:*:*:*:*range: <6.3.8
    • cpe:2.3:a:torchbox:wagtail:7.3:-:*:*:*:*:*:*
    • cpe:2.3:a:torchbox:wagtail:7.3:rc1:*:*:*:*:*:*
  • ghsa-coords
    pkg:pypi/wagtail
    Range: < 6.3.8
  • Wagtail/Wagtailv5
    Range: < 6.3.8

Patches

Vulnerability mechanics

References

11

News mentions

0

No linked articles in our index yet.