CVE-2026-28223
- Source
- https://cve.org/CVERecord?id=CVE-2026-28223
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-28223.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-28223
- Aliases
- Downstream
- Published
- 2026-03-05T18:56:41.835Z
- Modified
- 2026-07-15T01:48:57.288682960Z
- Severity
-
- 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N CVSS Calculator
- Summary
- Wagtail: Improper escaping of HTML (Cross-site Scripting) in simple_translation admin interface
- Details
-
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on confirmation messages within the wagtail.contrib.simple_translation module. A user with access to the Wagtail admin area may create a page with a specially-crafted title which, when another user performs the "Translate" action, causes arbitrary JavaScript code to run. This could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28223.json", "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-79" ] }- References
-
- https://github.com/wagtail/wagtail/releases/tag/v6.3.8
- https://github.com/wagtail/wagtail/releases/tag/v7.0.6
- https://github.com/wagtail/wagtail/releases/tag/v7.2.3
- https://github.com/wagtail/wagtail/releases/tag/v7.3.1
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28223.json
- https://github.com/wagtail/wagtail/security/advisories/GHSA-p4v8-rw59-93cq
- https://nvd.nist.gov/vuln/detail/CVE-2026-28223
- https://github.com/wagtail/wagtail/commit/1c6f2effed68f4ccad6fbd07987e03641505f863
- https://github.com/wagtail/wagtail/commit/ba70244d376a7b1bd180ded03e827917ff410c19
- https://github.com/wagtail/wagtail/commit/d8c5900982df8ed5938ad993aa9ff69cda50f80c
- https://github.com/wagtail/wagtail/commit/ee39d39deeb7f250fe886417b24802d7e05b1143
Affected packages
Git / github.com/wagtail/wagtail
Affected ranges
- Type
- GIT
- Repo
- https://github.com/wagtail/wagtail
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedIntroducedFixedIntroducedFixedIntroducedFixedFixedFixedFixedFixed
- Database specific
{ "extracted_events": [ { "introduced": "0" }, { "fixed": "6.3.8" }, { "introduced": "6.4" }, { "fixed": "7.0.6" }, { "introduced": "7.1" }, { "fixed": "7.2.3" }, { "introduced": "7.3-NA" }, { "last_affected": "7.3-NA" }, { "introduced": "7.3-rc1" }, { "last_affected": "7.3-rc1" } ], "source": [ "CPE_RANGE", "CPE_STRING", "REFERENCES" ], "cpe": [ "cpe:2.3:a:torchbox:wagtail:*:*:*:*:*:*:*:*", "cpe:2.3:a:torchbox:wagtail:7.3:-:*:*:*:*:*:*", "cpe:2.3:a:torchbox:wagtail:7.3:rc1:*:*:*:*:*:*" ] }
Affected versions
7.*
7.3-NA
7.3-rc1
v0.*
v0.1
v0.2
v0.4
v0.5
v0.6
v0.7
v0.8
v0.8.1
v1.*
v1.0b2
v1.0rc1
v1.10rc1
v1.1rc1
v1.2rc1
v1.3rc1
v1.4rc1
v1.5rc1
v1.6rc1
v1.8rc1
v2.*
v2.11.rc1
v2.16rc1
v2.2rc1
v2.8rc1
v4.*
v4.1rc1
v6.*
v6.3
v6.3.1
v6.3.2
v6.3.3
v6.3.4
v6.3.5
v6.3.6
v6.3.7
v6.3rc2
v7.*
v7.0
v7.0.1
v7.0.2
v7.0.3
v7.0.4
v7.0.5
v7.0rc1
v7.2
v7.2.1
v7.2.2
v7.2rc1
v7.3