Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

wagtail — Vulnerabilities & Security Advisories 26

All 26 CVE vulnerabilities found in wagtail, with AI-generated Chinese analysis, references, and POCs.

This page aggregates security vulnerabilities specific to the Wagtail content management system, focusing on weaknesses such as SQL injection, cross-site scripting, and path traversal identified within the software. The collection encompasses a comprehensive timeline of disclosed issues ranging from early releases to the most recent updates, capturing both critical and moderate severity flaws reported by the community and the core development team. Visitors can utilize this resource to track the vendor's official security advisories, understand the prevalence and impact of specific weakness classes within the Wagtail ecosystem, or examine the complete historical record of vulnerabilities affecting this product. The data serves as a centralized reference for security researchers, system administrators, and developers seeking to assess risk, plan remediation strategies, and maintain the integrity of their Wagtail installations. By consolidating these findings, the page facilitates a clearer understanding of the security posture evolution over time without requiring users to navigate multiple disparate sources. This aggregation supports proactive defense measures by highlighting recurring patterns and providing context for each reported incident. The information presented is derived from verified sources and is intended to aid in the timely identification and mitigation of potential threats to web applications built on the Wagtail framework.

Vendor: wagtail

CVE ID Title CVSS Severity Published
CVE-2026-55468 Wagtail: Improper restriction handling on Pages admin API CWE-280 4.3 Medium 2026-08-24
CVE-2026-54263 Wagtail: Reflected XSS in dynamic image URL generator view CWE-79 7.3 High 2026-07-01
CVE-2026-54262 Wagtail: Pages translations can be created without page permissions when using simple_translation CWE-280 4.3 Medium 2026-07-01
CVE-2026-54261 Wagtail: Improper permission handling in image preview CWE-280 6.5 Medium 2026-07-01
CVE-2026-54259 Wagtail: Improper restriction handling on Documents and Images chosen endpoints CWE-280 4.3 Medium 2026-07-01
CVE-2026-54260 Wagtail: Denial of service via unbounded filter specs in the image preview CWE-400 4.3 Medium 2026-07-01
CVE-2026-44201 Wagtail: Improper restriction handling on Documents and Images API CWE-280 5.3 Medium 2026-05-11
CVE-2026-44200 Wagtail: Improper permission handling when copying pages CWE-280 6.5 Medium 2026-05-11
CVE-2026-44199 Wagtail: Improper permission handling when deleting form submissions CWE-280 6.5 Medium 2026-05-11
CVE-2026-44198 Wagtail: Improper permission handling when viewing page history CWE-280 4.3 Medium 2026-05-11
CVE-2026-44197 Wagtail: Improper permission handling when comparing revisions CWE-280 6.5 Medium 2026-05-11
CVE-2026-28222 Wagtail: Improper escaping of HTML (Cross-site Scripting) on TableBlock class attributes CWE-79 6.1 Medium 2026-03-05
CVE-2026-28223 Wagtail: Improper escaping of HTML (Cross-site Scripting) in simple_translation admin interface CWE-79 6.1 Medium 2026-03-05
CVE-2026-25517 Wagtail has improper permission handling on admin preview endpoints CWE-862 5.3AI Medium AI 2026-02-04
CVE-2024-39317 Wagtail regular expression denial-of-service via search query parsing CWE-1333 6.5 Medium 2024-07-11
CVE-2024-35228 Improper Handling of Insufficient Permissions in Wagtail CWE-280 5.5 Medium 2024-05-30
CVE-2024-32882 Permission check bypass when editing a model with per-field restrictions in wagtail CWE-280 2.7 Low 2024-05-02
CVE-2023-45809 Disclosure of user names via admin bulk action views in wagtail CWE-200 2.7 Low 2023-10-19
CVE-2023-28837 Wagtail vulnerable to denial-of-service via memory exhaustion when uploading large files CWE-400 4.9 Medium 2023-04-03
CVE-2023-28836 Wagtail vulnerable to stored Cross-site Scripting attack via ModelAdmin views CWE-79 6.4 Medium 2023-04-03
CVE-2022-21683 Comment reply notifications sent to incorrect users in wagtail CWE-200 3.5 Low 2022-01-18
CVE-2021-32681 Improper escaping of HTML ('Cross-site Scripting') in Wagtail StreamField blocks CWE-79 5.4 Medium 2021-06-17
CVE-2021-29434 Improper validation of URLs ('Cross-site Scripting') in Wagtail rich text fields CWE-79 6.1 Medium 2021-04-19
CVE-2020-15118 Cross-Site Scripting in Wagtail CWE-79 5.7 Medium 2020-07-20
CVE-2020-11037 Potential Observable Timing Discrepancy in Wagtail CWE-208 6.1 Medium 2020-04-30
CVE-2020-11001 Possible XSS attack in Wagtail CWE-80 5.8 Medium 2020-04-14

All 26 known CVE vulnerabilities affecting wagtail with full Chinese analysis, references, and POCs where available.