CVE-2026-28222

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-28222
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-28222.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-28222
Aliases
Downstream
Published
2026-03-05T18:58:20.719Z
Modified
2026-04-10T05:42:18.659137Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Wagtail: Improper escaping of HTML (Cross-site Scripting) on TableBlock class attributes
Details

Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on rendering TableBlock blocks within a StreamField. A user with access to create or edit pages containing TableBlock StreamField blocks is able to set specially-crafted class attributes on the block which run arbitrary JavaScript code when the page is viewed. When viewed by a user with higher privileges, this could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, and only affects sites using TableBlock. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1.

Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28222.json"
}
References

Affected packages

Git / github.com/wagtail/wagtail

Affected ranges

Type
GIT
Repo
https://github.com/wagtail/wagtail
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
0a473e521df5eb31a1a7f1840b64527f7eeffaf3
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "6.3.8"
        }
    ]
}
Type
GIT
Repo
https://github.com/wagtail/wagtail
Events
Introduced
b7de2007d8d5722bdd6d1384de510eb3a727cc8b
Fixed
c445aa76d14da81dac591930942335dbbcd38ca8
Database specific 
{
    "versions": [
        {
            "introduced": "6.4rc1"
        },
        {
            "fixed": "7.0.6"
        }
    ]
}
Type
GIT
Repo
https://github.com/wagtail/wagtail
Events
Introduced
afd8aecc4bd6abec78809825861164255361cdd5
Fixed
b55a95d83acff5895b2c48894a5b1e7ad2dd2273
Database specific 
{
    "versions": [
        {
            "introduced": "7.1rc1"
        },
        {
            "fixed": "7.2.3"
        }
    ]
}
Type
GIT
Repo
https://github.com/wagtail/wagtail
Events
Introduced
2061a40b9b1c7e181efa9240f566ff7da2da8e33
Fixed
136e2f65957314f26bd2632adec08fe5ef9a1e25
Database specific 
{
    "versions": [
        {
            "introduced": "7.3rc1"
        },
        {
            "fixed": "7.3.1"
        }
    ]
}

Affected versions

v0.*
v0.1
v0.2
v0.4
v0.5
v0.6
v0.7
v0.8
v0.8.1
v1.*
v1.0b2
v1.0rc1
v1.10rc1
v1.1rc1
v1.2rc1
v1.3rc1
v1.4rc1
v1.5rc1
v1.6rc1
v1.8rc1
v2.*
v2.11.rc1
v2.16rc1
v2.2rc1
v2.8rc1
v4.*
v4.1rc1
v6.*
v6.3
v6.3.1
v6.3.2
v6.3.3
v6.3.4
v6.3.5
v6.3.6
v6.3.7
v6.3rc2
v7.*
v7.3
v7.3rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-28222.json"